[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fav0IK7Rpg20989VVlbwEdMaVIVFEmRpOwJ2Ia-nhSjU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"b5ebb260-6a23-4311-aa35-6573e41fd6e4","atlassian-patches-75-flaws-including-critical-third-party-component-vulnerabilities","e881c5f9-9bf2-44b5-a615-f3be785ab037","Atlassian Patches 75 Flaws Including Critical Third-Party Component Vulnerabilities","Atlassian's October bulletin reveals 75 vulnerabilities across its Data Center and Server products, six of which are rated critical — many originating from third-party libraries like Apache Tomcat, Netty, and Bouncy Castle. This highlights a growing supply chain risk: organizations inherit vulnerabilities from every open-source or third-party component embedded in their software stack. Even when a vendor assesses overall risk as non-critical, unpatched critical flaws in widely used enterprise platforms represent attractive targets for threat actors. Delaying updates because the vendor's risk rating seems manageable can leave organizations exposed to exploitation chains that elevate severity in real-world environments.","**Immediate actions:**\n- Apply Atlassian's latest patches to all affected Data Center and Server products without delay, prioritizing the six critical vulnerabilities.\n- Run an authenticated vulnerability scan across all Atlassian deployments to confirm patch status and identify any missed instances.\n\n**Long-term improvements:**\n- Maintain a Software Bill of Materials (SBOM) for all enterprise applications to gain visibility into embedded third-party components and their vulnerability exposure.\n- Establish a formal patch management policy with defined SLAs — e.g., critical patches applied within 72 hours, high within 7 days — enforced through automated compliance checks.\n- Implement network segmentation around Atlassian Data Center and Server deployments to limit blast radius if a vulnerability is exploited before patching is complete.\n\n**Detection measures:**\n- Subscribe to Atlassian's security advisories and third-party component CVE feeds (e.g., Apache Tomcat, Netty, Bouncy Castle) to receive proactive notification of new vulnerabilities.\n- Deploy a runtime application monitoring or WAF solution to detect and alert on exploitation attempts targeting known CVEs in these products.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires essential and important entities to implement measures for handling vulnerabilities and patch management as part of their cybersecurity risk management obligations, covering the need to act on Atlassian's security bulletin promptly.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities by installing applicable security patches, making it directly relevant for any organization running Atlassian products in a cardholder data environment.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined timeframes, which would enforce timely application of Atlassian's patches before exploitation occurs.","This OWASP risk category specifically addresses the danger of using components with known vulnerabilities — precisely the scenario here, where embedded libraries like Bouncy Castle and Apache Tomcat introduced critical flaws into Atlassian products.","This control mandates a continuous process of identifying, prioritizing, and remediating vulnerabilities — directly applicable here, where 75 flaws including six critical ones require timely patching of Atlassian products and their embedded components.","This control requires organizations to obtain timely information about technical vulnerabilities in used systems and take appropriate measures, directly covering the need to track and patch third-party component flaws like those in Apache Tomcat and Netty.","Unpatched vulnerabilities in Data Center and Server products can be exploited to bypass access controls; maintaining patched systems is a prerequisite for ensuring that authentication and access mechanisms function as intended.","published","2026-10-23T10:21:42.601681+00:00","2026-10-23T10:21:42.584+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.securityweek.com\u002Fatlassian-patches-75-third-party-flaws-in-data-center-and-server-products\u002F","atlassian-patches-75-flaws-in-data-center-and-server-products-87fa2c","Atlassian Patches 75 Flaws in Data Center and Server Products",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,56],{"slug":50,"name":51,"problem":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":38,"name":54,"problem":55},"Automated patch management","Known holes get closed in days, not months.",{"slug":57,"name":58,"problem":59},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]