Vulnerabilities · 1 day ago
Atlassian’s October 2026 security bulletin lists 176 third-party vulnerability entries across seven Data Center and Server products, but those entries represent 75 unique CVEs, according to SecurityWeek’s count. The bulletin has 14 critical entries; six distinct CVEs are critical.
The same library flaw can appear under several Atlassian products, so the entries repeat CVEs rather than indicate separate defects. The critical issues affect Apache Tomcat, Bouncy Castle, Netty and Apache MINA SSHD. Atlassian says its particular use of these components carries lower, non-critical assessed risk—a qualification specific to its products, not necessarily to standalone deployments of those libraries. SecurityWeek also found CVE-2026-65905, a critical Tomcat flaw listed on Atlassian’s disclosure portal as affecting Data Center and Crowd, missing from the bulletin. The bulletin does not mention exploitation.
If your estate runs Atlassian products alongside these libraries independently, Atlassian’s lower-risk assessment applies only to the former. The disclosure mismatch also means the bulletin and portal do not present a consistent inventory of issues.
CVEs in this update
7 CVEs
Across Apache Tomcat, Bamboo, Bitbucket, and related packages.
3 critical · 0 high · 0 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-77185 · 9.1 CRITICAL
Highest EPSS: CVE-2026-65637 · 0.57%
1 source covering this story
Atlassian Patches 75 Flaws in Data Center and Server Products
Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.
Part of the PlainSec briefing for 2026-10-24