Atlassian

Atlassian October Security Bulletin Flags 176 Third-Party Library Vulnerabilities Across Jira, Confluence and Bitbucket

Atlassian released its October security bulletin detailing 176 vulnerability entries distributed across seven products including Jira, Confluence, Bamboo, Bitbucket, Crowd, Fisheye and Crucible. Of these, 162 entries carry high severity and 14 are rated critical, though the total does not represent 176 unique flaws because the same identifiers recur when multiple products share the same third-party library. All critical issues originate in external components rather than Atlassian code, with the most severe being CVE-2026-65637 in the Coyote component of Apache Tomcat used by Confluence, which allows interception of server-client connections. Affected versions and corresponding fixes were published for Confluence Data Center, Bamboo, Bitbucket Data Center, Jira Software and Jira Service Management, with the company stressing that administrators must compare exact build numbers against the full corrected-version table. No exploitation of the listed issues had been reported as of 22 October, and Atlassian classifies the inherited exposure from third-party libraries as lower priority, issuing separate critical alerts only for immediate-risk cases.

CISA Adds Five Exploited Vulnerabilities to KEV Catalog Including AhsayCBS Authentication and Command Injection Flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. Four vulnerabilities were registered on October 14, 2026, and one additional entry followed on October 15. Among the newly listed issues are two critical flaws affecting the AhsayCBS backup management server: CVE-2026-105133, an authentication bypass in the API, and CVE-2026-105134, a command injection vulnerability in the replication feature. When chained together, the pair allows unauthenticated remote attackers to execute arbitrary operating system commands. Vendor Ahsay has released hotfixes in versions 10.3.4.45 and 9.15.2.70 because standard patches cannot fully address the issues. The advisory also references vulnerabilities in Atlassian products and multiple network security solutions from other vendors.

Critical CVE-2026-21589 Affects Eight Atlassian Products with CVSS 9.3 Score

Atlassian has disclosed a critical vulnerability tracked as CVE-2026-21589 that impacts eight of its products. The flaw allows unauthenticated access to specific files located in the web application's root directory when an attacker already knows the file name and path. Products affected include Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian rates the issue Critical with a CVSSv4.0 base score of 9.3 and warns that Data Center editions face elevated risk due to potential exposure of sensitive files. The company released patches for all affected products and urges immediate updates, while also providing mitigation steps and indicators of compromise for organizations unable to patch right away.