Atlassian security advisories, October 2026

Every Atlassian security advisory published in October 2026, from Atlassian ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 64
Critical: 6
High: 59
In CISA KEV: 1
CVEs: 64

Atlassian advisories published in October 2026

Oct 20, 2026
Critical [CVE-2026-58062] Cryptographic Failure org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center
Critical9.3
Oct 20, 2026
Critical [CVE-2026-65182] Improper Authorization org.apache.tomcat:tomcat-catalina Dependency in Confluence Data Center
Critical9.1
Oct 20, 2026
Critical [CVE-2026-65637] MITM (Man-in-the-Middle) org.apache.tomcat:tomcat-coyote Dependency in Confluence Data Center
Critical9.8
Oct 20, 2026
Critical [CVE-2026-75595] BASM (Broken Authentication & Session Management) io.netty:netty-handler Dependency in Confluence Data Center
Critical9.1
Oct 20, 2026
Critical [CVE-2026-77185] BASM (Broken Authentication & Session Management) org.apache.sshd:sshd-core Dependency in Crucible Server
Critical9.1
Oct 20, 2026
High [CVE-2026-101898] MITM (Man-in-the-Middle) axios Dependency in Crowd Data Center
High7.2
Oct 20, 2026
High [CVE-2026-101901] DoS (Denial of Service) axios Dependency in Crowd Data Center
High7.5
Oct 20, 2026
High [CVE-2026-101903] DoS (Denial of Service) axios Dependency in Confluence Data Center
High8.2
Oct 20, 2026
High [CVE-2026-101907] SSRF (Server-Side Request Forgery) axios Dependency in Crowd Data Center
High8.6
Oct 20, 2026
High [CVE-2026-101909] Prototype Pollution axios Dependency in Crowd Data Center
High8.2
Oct 20, 2026
High [CVE-2026-12185] RCE (Remote Code Execution) org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center
High7.1
Oct 20, 2026
High [CVE-2026-12802] Cryptographic Failure org.bouncycastle:bcpkix-lts8on Dependency in Bitbucket Data Center
High8.7
Oct 20, 2026
High [CVE-2026-12860] Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center
High8.7
Oct 20, 2026
High [CVE-2026-13006] Injection ch.qos.logback:logback-core Dependency in Confluence Data Center
High7.0
Oct 20, 2026
High [CVE-2026-13676] SSRF (Server-Side Request Forgery) fast-uri Dependency in Confluence Data Center
High7.5
Oct 20, 2026
High [CVE-2026-14682] DoS (Denial of Service) org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk18on Dependency in Bitbucket Data Center
High8.7
Oct 20, 2026
High [CVE-2026-18036] Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Jira Software Data Center
High8.2
Oct 20, 2026
High [CVE-2026-19534] DoS (Denial of Service) undici Dependency in Jira Software Data Center
High7.5
Oct 20, 2026
High [CVE-2026-19693] File Inclusion extract-zip Dependency in Confluence Data Center
High8.1
Oct 20, 2026
High [CVE-2026-41842] DoS (Denial of Service) org.springframework:spring-webmvc Dependency in Confluence Data Center
High7.5
Oct 20, 2026
High [CVE-2026-41845] XSS (Cross Site Scripting) org.springframework:spring-web Dependency in Confluence Data Center
High7.1
Oct 20, 2026
High [CVE-2026-41850] DoS (Denial of Service) org.springframework:spring-expression Dependency in Confluence Data Center
High7.5
Oct 20, 2026
High [CVE-2026-49434] Injection org.apache.activemq:activemq-broker Dependency in Bamboo Data Center
High7.5
Oct 20, 2026
High [CVE-2026-50750] DoS (Denial of Service) org.apache.activemq:activemq-broker Dependency in Bamboo Data Center
High7.5
Oct 20, 2026
High [CVE-2026-53404] DoS (Denial of Service) org.apache.tomcat.embed:tomcat-embed-core Dependency in Bitbucket Data Center
High7.3
Oct 20, 2026
High [CVE-2026-54399] DoS (Denial of Service) org.apache.httpcomponents.core5:httpcore5 Dependency in Bamboo Data Center
High7.5
Oct 20, 2026
High [CVE-2026-54428] DoS (Denial of Service) org.apache.httpcomponents.core5:httpcore5-h2 Dependency in Bitbucket Data Center
High7.5
Oct 20, 2026
High [CVE-2026-54512] DoS (Denial of Service) in jackson-databind Dependency in Confluence Data Center
High8.1
Oct 20, 2026
High [CVE-2026-54513] Insecure Deserialization in jackson-databind Dependency in Confluence Data Center
High8.1
Oct 20, 2026
High [CVE-2026-55153] Insecure Deserialization com.mchange:mchange-commons-java Dependency in Crowd Data Center
High7.1
Oct 20, 2026
High [CVE-2026-55831] DoS (Denial of Service) io.netty:netty-codec-http Dependency in Bitbucket Data Center
High7.5
Oct 20, 2026
High [CVE-2026-59641] Cryptographic Failure in org.bouncycastle:bcmail-lts8on Dependency in Confluence Data Center
High8.7
Oct 20, 2026
High [CVE-2026-59645] DoS (Denial of Service) org.bouncycastle:bcutil-jdk18on Dependency in Bamboo Data Center
High8.7
Oct 20, 2026
High [CVE-2026-59651] Security Misconfiguration org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center
High7.1
Oct 20, 2026
High [CVE-2026-59903] Information Disclosure io.netty:netty-codec-http Dependency in Bamboo Data Center
High7.5
Oct 20, 2026
High [CVE-2026-62243] BASM (Broken Authentication & Session Management) io.netty:netty-handler Dependency in Bamboo Data Center
High8.7
Oct 20, 2026
High [CVE-2026-65183] Race condition org.apache.tomcat:tomcat-coyote Dependency in Bamboo Data Center
High8.1
Oct 20, 2026
High [CVE-2026-65927] DoS (Denial of Service) org.apache.tomcat:tomcat-catalina Dependency in Bamboo Data Center
High7.5
Oct 20, 2026
High [CVE-2026-66422] Improper Authorization org.apache.tomcat:tomcat-catalina Dependency in Bamboo Data Center
High8.1
Oct 20, 2026
High [CVE-2026-67213] DoS (Denial of Service) nanoid Dependency in Bamboo Data Center and Server
High8.2
Oct 20, 2026
High [CVE-2026-67214] DoS (Denial of Service) nanoid Dependency in Bamboo Data Center and Server
High8.2
Oct 20, 2026
High [CVE-2026-68494] DoS (Denial of Service) com.fasterxml.jackson.core:jackson-core, tools.jackson.core:jackson-core Dependency in Jira Software Data Center
High8.7
Oct 20, 2026
High [CVE-2026-68495] DoS (Denial of Service) com.fasterxml.jackson.dataformat:jackson-dataformat-cbor, tools.jackson.dataformat:jackson-dataformat-cbor Dependency in Confluence Data Center
High7.5
Oct 20, 2026
High [CVE-2026-68497] DoS (Denial of Service) tools.jackson.core:jackson-databind Dependency in Crowd Data Center
High7.5
Oct 20, 2026
High [CVE-2026-68498] DoS (Denial of Service) tools.jackson.core:jackson-core Dependency in Crowd Data Center
High7.5
Oct 20, 2026
High [CVE-2026-68569] BASM (Broken Authentication & Session Management) org.apache.tomcat:tomcat-catalina Dependency in Bamboo Data Center
High8.1
Oct 20, 2026
High [CVE-2026-68763] DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Confluence Data Center
High7.5
Oct 20, 2026
High [CVE-2026-71888] Cryptographic Failure org.bouncycastle:bcpkix-jdk18on, org.bouncycastle:bcutil-jdk18on Dependency in Bamboo Data Center
High8.7
Oct 20, 2026
High [CVE-2026-71889] Cryptographic Failure org.bouncycastle:bcpkix-jdk18on, org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center
High7.5
Oct 20, 2026
High [CVE-2026-71891] Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center
High7.1
Oct 20, 2026
High [CVE-2026-73086] CSRF (Cross-Site Request Forgery) nanoid Dependency in Bamboo Data Center
High7.4
Oct 20, 2026
High [CVE-2026-73507] DoS (Denial of Service) io.netty:netty-codec Dependency in Bitbucket Data Center
High7.5
Oct 20, 2026
High [CVE-2026-73508] DoS (Denial of Service) io.netty:netty-codec-dns Dependency in Bitbucket Data Center
High7.5
Oct 20, 2026
High [CVE-2026-73634] DoS (Denial of Service) org.apache.struts:struts2-core Dependency in Crowd Data Center
High7.5
Oct 20, 2026
High [CVE-2026-73646] Path Traversal (Arbitrary Read/Write) postcss Dependency in Confluence Data Center
High7.5
Oct 20, 2026
High [CVE-2026-75140] DoS (Denial of Service) org.jsoup:jsoup Dependency in Bamboo Data Center
High7.5
Oct 20, 2026
High [CVE-2026-75596] DoS (Denial of Service) io.netty:netty-handler Dependency in Bamboo Data Center
High8.7
Oct 20, 2026
High [CVE-2026-75975] SSRF (Server-Side Request Forgery) fast-uri Dependency in Bamboo Data Center
High7.5
Oct 20, 2026
High [CVE-2026-84292] SSRF (Server-Side Request Forgery) fast-uri Dependency in Jira Software Data Center
High7.5
Oct 20, 2026
High [CVE-2026-84375] DoS (Denial of Service) js-yaml Dependency in Jira Software Data Center
High7.5
Oct 20, 2026
High [CVE-2026-93488] DoS (Denial of Service) io.netty:netty-codec-http Dependency in Bamboo Data Center
High7.5
Oct 20, 2026
High [CVE-2026-93690] DoS (Denial of Service) uri-js Dependency in Bamboo Data Center
High8.7
Oct 20, 2026
High [CVE-2026-93748] Information Disclosure http-cache-semantics Dependency in Jira Software Data Center
High7.5
Oct 5, 2026
Critical [CVE-2026-21589] This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center
Critical9.3ExploitedCISA KEV

Get an email when Atlassian publishes the next one.

See Atlassian's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Atlassian

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.