Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and Confluence

What happened?

Atlassian has released its October 2026 security bulletin, covering 176 flaw entries across products including Jira, Confluence, Bamboo, Bitbucket, and Crowd. Published on October 20, the update lists 162 high-severity entries and 14 critical-severity third-party entries. Atlassian says it included fixes in product versions released last month and urges customers to install a suitable fixed release. The total should not be read as 176 unique CVEs affecting Jira and Confluence alone.

Key details

• Atlassian published an October 2026 security bulletin covering 176 flaw entries across multiple products.
• The bulletin includes 162 high-severity and 14 critical-severity third-party entries.
• Some CVE identifiers appear across several applications that share the same software libraries.
• Confluence has a critical man-in-the-middle issue in Apache Tomcat Coyote dependency rated CVSS 9.8.
• Critical entries also include a Bouncy Castle cryptographic failure and a Netty authentication weakness.
• Atlassian states critical ratings describe flaws in outside libraries, not necessarily critical risk in its products.
• Administrators must check each installed product against the full fixed-version table rather than rely on major version numbers.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.