Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and Confluence

Atlassian has released its October 2026 security bulletin, covering 176 flaw entries across products including Jira, Confluence, Bamboo, Bitbucket, and Crowd.

Published on October 20, the update lists 162 high-severity entries and 14 critical-severity third-party entries. Atlassian says it included fixes in product versions released last month and urges customers to install a suitable fixed release.

The total should not be read as 176 unique CVEs affecting Jira and Confluence alone. The official security bulletin lists findings by product, with some CVE identifiers appearing across several applications that use the same software libraries.

This means administrators must check each installed product rather than treat the announcement as a single patch. A key finding in Confluence is CVE-2026-65637, a man-in-the-middle issue in the Apache Tomcat Coyote dependency with a CVSS score of 9.8.

Other critical entries include CVE-2026-58062, a cryptographic failure in Bouncy Castle rated 9.3, and CVE-2026-75595, an authentication and session management weakness in Netty rated 9.1.

Atlassian Releases Security Update

Confluence also has two improper authorization entries, CVE-2026-65182 and CVE-2026-68525, affecting the Tomcat Catalina dependency.

These findings sit alongside high-severity issues involving denial of service, unsafe data handling, file inclusion, path traversal, and remote code execution in third-party components.

However, severity needs careful reading. Atlassian says the critical ratings describe flaws in outside libraries. In contrast, its use of those libraries presents a lower, non-critical assessed risk.

The company reserves separate critical security advisories for issues that pose an immediate critical risk in its products. Therefore, the library scores do not mean every affected Atlassian installation faces the same level of exposure.

For Confluence, the security bulletin lists 11.0.0, 10.2.19 LTS, and 9.2.26 LTS as fixed Data Center releases, with 10.2.19 LTS recommended.

Affected branches include 10.2.0 through 10.2.18 and 9.2.0 through 9.2.25, alongside several older releases. Administrators should compare their exact build against the full table rather than rely only on the major version number.

Bamboo customers are directed to 12.1.12 LTS or 10.2.24 LTS. Bitbucket fixes include 10.5.1, 10.2.8 LTS, and 9.4.26 LTS. The bulletin marks these fixed releases as Data Center only. Its product headings also mention Server, so customers should read the release labels carefully when planning upgrades.

Jira administrators should also review the recent Atlassian arbitrary file access security update. That separate advisory covered CVE-2026-21589 and identified Jira Software and Jira Service Management fixes including 10.3.26 and 11.3.12. It should not be confused with the third-party dependency findings in this monthly bulletin.

Previous attacks show why delayed Confluence updates deserve attention. Cybersecurity News documented attackers using an older, separate flaw, CVE-2023-22527, to deploy the Godzilla fileless backdoor. That case provides historical context, not evidence that attackers are exploiting the October 2026 findings.

Atlassian recommends upgrading to the latest release or a listed fixed version for each affected product. Because the fixed-version table reflects information available on October 20, customers should also check the linked release notes before scheduling deployment. The practical priority is to match every installed application to its patch path, including products that share vulnerable libraries.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and Confluence appeared first on Cyber Security News.