Atlassian's October 2026 bulletin lists 75 unique CVEs, all in third-party components

Past-week coverage · Original source published 2026-10-23.

Atlassian's October 2026 security bulletin lists 162 high-severity and 14 critical-severity vulnerability entries, all tied to third-party dependencies, SecurityWeek reported. By the outlet's count, the entries cover 75 unique CVEs, six of them critical, with many appearing under several products.

The affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. The critical-severity flaws SecurityWeek listed involve Apache Tomcat, Bouncy Castle, Netty and Apache SSHD. For each, Atlassian says its use of the affected component "presents a lower, non-critical assessed risk," and the company states that CVEs in its monthly bulletins have been assessed as non-critical for its customers.

The remaining high-severity issues sit in widely used open source libraries, including Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts and Apache ActiveMQ. Many are denial-of-service bugs; others are described as cryptographic weaknesses, authentication and authorization problems, server-side request forgery, information disclosure and code execution flaws.

Atlassian made no mention of any of these being exploited and recommends updating to the latest versions or the fixed releases in the bulletin. SecurityWeek noted that attackers often move quickly on Atlassian flaws, citing CVE-2026-21589, a critical Data Center issue that drew targeting within hours of a proof-of-concept being published.

Defenders should treat the bulletin as a patch-prioritization exercise: inventory which listed components each deployment actually uses, then apply the fixed releases Atlassian names rather than assuming every entry carries equal risk.

CVE references

CVE-2026-21589