> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Atlassian patches 75 third-party flaws in Jira and Confluence Data Center products - URL: https://f4n6.co.uk/security-feed/atlassian-patches-75-third-party-flaws-in-jira-and-confluence-data-center-products/ - Published: 2026-10-23T18:12:34.000Z - Updated: 2026-10-23T18:12:34.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-65637, CVE-2026-65182, CVE-2026-68525, CVE-2026-58062, CVE-2026-75595 ## 1\. Executive summary Atlassian's October 2026 security bulletin covers 75 unique CVEs across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management, all inherited from third-party dependencies. Six are rated critical: CVE-2026-65637 (CVSS 9.8), CVE-2026-65182 (9.1) and CVE-2026-68525 (9.1) in Apache Tomcat, CVE-2026-58062 (9.3) in Bouncy Castle, CVE-2026-75595 (9.1) in Netty and CVE-2026-77185 (9.1) in Apache SSHD. None of the six is in CISA KEV and EPSS sits at 0 to 1 percent for each, so the immediate exploitation risk is low; Atlassian itself assesses the bundled components as presenting a lower, non-critical risk in its products. The material risk to EMEA financial services sits elsewhere: CVE-2026-21589 (CVSS 9.3, CWE-552), the unauthenticated file-read flaw in the same Data Center products, is in CISA KEV with a remediation due date of 2026-10-18 that has already passed, and SecurityWeek reports attackers began targeting it within hours of a proof-of-concept being published. Self-hosted Atlassian estates that carry regulated content and have not yet been patched for CVE-2026-21589 are the priority, not the October bulletin. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | CVE-2026-21589 permits unauthenticated read of files in the web application root of self-hosted Data Center products, and Atlassian states it cannot confirm whether customer instances have been affected, directing customers to check for evidence of compromise. | The ICT-related incident management process must cover detection and triage of unauthorised file access on self-hosted collaboration platforms, including a documented method for checking instances against the vendor's guidance. | | DORA Art. 28 | The bulletin's 75 CVEs are all inherited from third-party dependencies (Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Struts, ActiveMQ) embedded in products the client hosts. | Third-party risk management must extend to transitive open-source components inside self-hosted products, not only to the Atlassian contract itself; the client needs a route to know which dependency versions its installed releases carry. | ## 3\. Technical analysis & attack chain This is a vendor patch cycle covering 75 unique CVEs, six of them critical. The table below orders the critical entries by EPSS from NVD and EPSS data; the KEV-listed CVE-2026-21589 is handled separately because it is not part of the October bulletin. | CVE | Component | CVSS | KEV / EPSS | Why it matters | | -------------- | ------------------------------------------------------------------------- | ---- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2026-65637 | Apache Tomcat (Confluence, Crowd) | 9.8 | Not KEV / 1% | Improper input validation (CWE-20); highest CVSS in the bulletin. | | CVE-2026-65905 | Apache Tomcat (Data Center, Crowd) | 9.8 | Not KEV / 1% | Authentication bypass by capture-replay (CWE-294); listed on Atlassian's disclosure portal for 2026-10-20 but absent from the bulletin. | | CVE-2026-58062 | Bouncy Castle (Confluence, Crowd, Jira Software, Jira Service Management) | 9.3 | Not KEV / 0% | Improper certificate validation (CWE-295); widest product spread of the critical set. | | CVE-2026-65182 | Apache Tomcat (Confluence, Crowd) | 9.1 | Not KEV / 1% | Improper access control and incorrect authorization (CWE-284, CWE-863). | | CVE-2026-68525 | Apache Tomcat (Confluence, Crowd) | 9.1 | Not KEV / 0% | Incorrect authorization (CWE-863). | | CVE-2026-75595 | Netty (Confluence, Jira Software, Jira Service Management) | 9.1 | Not KEV / 0% | CWE-754, improper check for unusual or exceptional conditions. | | CVE-2026-77185 | Apache SSHD (Fisheye/Crucible) | 9.1 | Not KEV / 1% | Authentication bypass by primary weakness (CWE-305). | The remaining high-severity entries affect the same dependency set plus Jackson, Axios, Spring, Apache Struts and Apache ActiveMQ. SecurityWeek reports many are denial-of-service issues, with others described as cryptographic weaknesses, authentication and authorization problems, server-side request forgery, information disclosure and code execution bugs. The bulletin does not give per-CVE mechanism detail in the source material, so no per-CVE attack chain is drawn here; the vector descriptions above are the classification, not an exploitation narrative. The one CVE with a confirmed exploitation history is CVE-2026-21589, and it is the reason this advisory carries weight. Atlassian published it on 5 October 2026 with a CVSS 4.0 score of 9.3 calculated through its internal assessment. The flaw allows an unauthenticated attacker to access specific files within the web application root directory of affected Data Center installations. Two constraints limit it: the attacker must know the exact filename and path, and the flaw does not permit directory listing or enumeration. Atlassian warns that in some configurations sensitive files may be present in that root, which raises the impact. Affected products are Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. Atlassian's cloud products were patched and cloud customers need take no action. The confirmed attack chain for CVE-2026-21589, as far as the sources establish it: 1. The attacker identifies a target file name and path inside the web application root of an internet-facing Data Center instance. No credential is required. 2. The attacker requests that path directly. The application returns the file contents without authentication. 3. The attacker cannot enumerate the directory, so the step depends on knowing the path in advance. Atlassian does not state which files are exposed beyond "specific files" and the warning that sensitive files may be present in some configurations. 4. SecurityWeek reports attackers began targeting the flaw within hours of a proof-of-concept being published. The sources do not name the actor, the tooling, or the post-access activity. Fixed versions for CVE-2026-21589, from Atlassian's advisory: Bitbucket Data Center 9.4.26, 10.2.8 and 10.5.1; Confluence Data Center 9.2.26 and 10.2.19; Jira Software Data Center and Jira Service Management Data Center 10.3.26 and 11.3.12, plus 9.12.40 for Jira Software and 5.12.40 for Jira Service Management; Bamboo Data Center 10.2.24 and 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7 and 7.2.4; Crucible and Fisheye 4.9.15. Two discrepancies need flagging. First, the CISA KEV catalogue entry for CVE-2026-21589 gives a due date of 2026-10-18, which precedes this advisory's issue date; the KEV record also lists known ransomware campaign use as unknown, so no ransomware linkage is asserted. Second, CVE-2026-65905 appears on Atlassian's vulnerability disclosure portal as disclosed on 20 October affecting Data Center and Crowd, but does not appear in the October bulletin, and the portal lists fewer unique CVEs than the bulletin. Treat the bulletin as incomplete for that CVE and check the portal directly. Attribution: no actor is named in any source for either CVE-2026-21589 or the October bulletin, and no MITRE ATT&CK profile applies. Any attribution would be unconfirmed. ## 4\. Mitigation & containment ### P1, within 24 hours Patch or isolate every internet-facing Data Center instance for CVE-2026-21589\. The KEV due date of 2026-10-18 has passed. Where a change window is not available, Atlassian's guidance is to restrict external network access: "Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can take action." Apply the fixed versions listed in §3\. Atlassian has published three temporary mitigations in its advisory for customers who cannot patch immediately; retrieve them from the vendor bulletin rather than substituting generic WAF rules. Run the compromise check Atlassian directs customers to perform on all affected instances. Atlassian states it cannot confirm whether customer instances have been affected. Review web server and reverse-proxy access logs for unauthenticated requests to paths under the application root that returned 200, particularly requests for configuration, properties or credential-bearing files. The sources do not name specific target filenames, so scope the review to any file in the root that should not be publicly readable. ### P2, within 72 hours Inventory installed versions of all eight Data Center products against the fixed-version list. Record which release each instance runs and whether it is internet-facing. Instances on the Atlassian cloud need no action for CVE-2026-21589. For the October bulletin, upgrade to the latest product versions or the fixed releases named in the bulletin. Because all 75 CVEs are third-party dependencies, the fixed release is the only reliable remediation; there is no configuration workaround for the embedded library versions. Prioritise Confluence and Crowd, which carry four of the six critical CVEs (CVE-2026-65637, CVE-2026-65182, CVE-2026-68525, CVE-2026-58062), then Jira Software and Jira Service Management (CVE-2026-58062, CVE-2026-75595), then Fisheye/Crucible (CVE-2026-77185). Check Atlassian's vulnerability disclosure portal for CVE-2026-65905 and confirm whether the installed Tomcat version in Data Center and Crowd is affected, since the bulletin omits it. ### P3, within 7 days Add the embedded dependency set (Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Struts, ActiveMQ) to the software bill of materials for self-hosted Atlassian estates so future bulletins can be triaged against installed versions without a manual release-by-release check. Where Fisheye/Crucible or Crowd are deployed but unused, decommission them; they widen exposure for no operational benefit. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe a vulnerability class and fixed versions, not atomic artefacts. No hashes, domains, IP addresses or file paths attributable to exploitation appear in any source, and none are fabricated here. ## 6\. Detection Insufficient indicators to author detection rules. The sources give no distinctive strings, command-line flags, filenames, registry keys or network artefacts belonging to the threat. The only exploitable detail is that requests target known file paths in the web application root without authentication, and the sources do not name those paths. A rule built on CVE identifiers or product names would detect reporting about the flaw, not exploitation of it. ## CVE assessment 8 referenced CVEs — **1 actively exploited (CISA KEV)**, 8 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-21589](https://nvd.nist.gov/vuln/detail/CVE-2026-21589?ref=f4n6.co.uk) | 9.3 Critical | ⚠ KEV 2026-10-15 | 13% | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Da… | | [CVE-2026-65637](https://nvd.nist.gov/vuln/detail/CVE-2026-65637?ref=f4n6.co.uk) | 9.8 Critical | — | 1% | Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990\. This issue affects Apache… | | [CVE-2026-65905](https://nvd.nist.gov/vuln/detail/CVE-2026-65905?ref=f4n6.co.uk) | 9.8 Critical | — | 1% | Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests h… | | [CVE-2026-58062](https://nvd.nist.gov/vuln/detail/CVE-2026-58062?ref=f4n6.co.uk) | 9.3 Critical | — | 0% | In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue al… | | [CVE-2026-65182](https://nvd.nist.gov/vuln/detail/CVE-2026-65182?ref=f4n6.co.uk) | 9.1 Critical | — | 1% | Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constr… | | [CVE-2026-68525](https://nvd.nist.gov/vuln/detail/CVE-2026-68525?ref=f4n6.co.uk) | 9.1 Critical | — | 0% | Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constra… | | [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595?ref=f4n6.co.uk) | 9.1 Critical | — | 0% | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.… | | [CVE-2026-77185](https://nvd.nist.gov/vuln/detail/CVE-2026-77185?ref=f4n6.co.uk) | 9.1 Critical | — | 1% | Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presume… | ## 7\. Sources - SecurityWeek, "Atlassian Patches 75 Flaws in Data Center and Server Products", 2026-10-23\. https://www.securityweek.com/atlassian-patches-75-third-party-flaws-in-data-center-and-server-products/ - NVD / CISA KEV, CVE-2026-21589, Atlassian Multiple Products. https://nvd.nist.gov/vuln/detail/CVE-2026-21589 - The Register, "Atlassian warns of critical file access flaw in its datacenter products", 2026-10-06\. https://www.theregister.com/security/2026/10/06/atlassian-warns-of-critical-file-access-flaw-in-its-datacenter-products/5301284 - Help Net Security, "Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589)", 2026-10-06\. https://www.helpnetsecurity.com/2026/10/06/atlassian-data-center-cve-2026-21589/ - The Hacker News, "Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products". https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html - SecurityWeek, "Atlassian Patches Critical Vulnerability Affecting 8 Products". https://www.securityweek.com/atlassian-patches-critical-vulnerability-affecting-8-products/ - SecurityWeek, "Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities". https://www.securityweek.com/atlassian-splunk-patch-dozens-of-critical-high-severity-vulnerabilities/ ## 8\. Adverse Trace position The October bulletin is a low-urgency patch cycle: six critical CVEs, none in CISA KEV, EPSS at 0 to 1 percent, no reported exploitation, and Atlassian's own assessment that the bundled components present a lower, non-critical risk in its products. We do not inflate it. CVE-2026-21589 is the item that matters, and it is already past its KEV due date of 2026-10-18 with public reporting of targeting within hours of a PoC. The exploitation detail rests on SecurityWeek's reporting and Atlassian's advisory; the actor is unnamed and attribution is unconfirmed. We assess that EMEA financial services firms running self-hosted Confluence, Jira, Bitbucket, Bamboo, Crowd or Fisheye/Crucible on internet-facing addresses should treat CVE-2026-21589 as an open exposure until the fixed version is confirmed installed and the compromise check is complete. We will monitor Atlassian's disclosure portal for CVE-2026-65905 and for any change in KEV or EPSS status across the six critical bulletin CVEs, and will reissue if exploitation of any of them is reported. --- [Read the original source →](https://www.securityweek.com/atlassian-patches-75-third-party-flaws-in-data-center-and-server-products/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*