Atlassian Patches 75 Flaws in Data Center and Server Products

Atlassian's October 2026 security bulletin covers 75 unique CVEs, six rated critical, affecting Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. All flaws stem from third-party dependencies such as Apache Tomcat, Netty and Bouncy Castle. Atlassian reports no exploitation and urges customers to update to fixed releases.

• 75 unique CVEs, including 6 critical and 162 high-severity entries
• Affected products include Confluence, Jira, Bitbucket, Bamboo and Crowd
• Critical flaws trace to Apache Tomcat, Bouncy Castle, Netty and Apache SSHD
• No exploitation reported; Atlassian advises updating to fixed versions