Atlassian’s October 2026 security bulletin lists 176 third-party vulnerability entries across seven Data Center and Server products, but those entries represent 75 unique CVEs, according to SecurityWeek’s count. The bulletin has 14 critical entries; six distinct CVEs are critical.
The same library flaw can appear under several Atlassian products, so the entries repeat CVEs rather than indicate separate defects. The critical issues affect Apache Tomcat, Bouncy Castle, Netty and Apache MINA SSHD. Atlassian says its particular use of these components carries lower, non-critical assessed risk—a qualification specific to its products, not necessarily to standalone deployments of those libraries. SecurityWeek also found CVE-2026-65905, a critical Tomcat flaw listed on Atlassian’s disclosure portal as affecting Data Center and Crowd, missing from the bulletin. The bulletin does not mention exploitation.
If your estate runs Atlassian products alongside these libraries independently, Atlassian’s lower-risk assessment applies only to the former. The disclosure mismatch also means the bulletin and portal do not present a consistent inventory of issues.
1 source · 1 day ago
CVEs in this update
7 CVEs
Across Apache Tomcat, Bamboo, Bitbucket, and related packages.