.jpg?w=1024)
Atlassian has released security fixes for Jira, Confluence, and other enterprise products, addressing 176 vulnerability entries across its software.
Published Oct. 20, the bulletin summarizes fixes released during the preceding month for multiple self-managed products. Some affected third-party components carry critical severity ratings, but Atlassian assesses their risk within its applications as non-critical. Organizations running affected versions should check which installations still require updates.
Some of the most serious findings affect software components that help prevent unauthorized connections to enterprise systems.
Security flaws affect server access and certificate checks
Several of the highest-rated issues involve third-party software libraries used to manage secure connections. Atlassian's security disclosure identifies three notable vulnerabilities, with the following scores listed in its bulletin:
- CVE-2026-65637 (9.8) in Apache Tomcat. Affecting Confluence and Crowd, the flaw can bypass strict Server Name Indication (SNI) validation for certain HTTP/2 requests.
- CVE-2026-58062 (9.3) in Bouncy Castle. Faulty certificate validation can cause a revoked certificate to be accepted as valid when the component receives a mismatched certificate-status response. Atlassian lists Jira Software, Jira Service Management, Confluence, and Crowd as affected.
- CVE-2026-75595 (9.1) in Netty. The network component can allow attackers to bypass client-certificate authentication when authentication depends entirely on SNI-based configuration, the fallback configuration permits connections without a certificate, and the application performs no additional certificate verification.
Other entries involve remote code execution and denial-of-service flaws. Of the total, 162 are rated high severity and 14 involve critical-rated third-party components, with some CVEs listed across multiple products.
Atlassian considers their impact within its applications non-critical despite the components’ higher severity scores.
Fixed releases are available for supported Data Center products
Recommended updates vary by product and release branch. The Oct. 20 bulletin recommends the following versions; administrators should check current release notes and upgrade requirements before deployment:
Product | Recommended fixed version |
| Jira Software Data Center | 11.3.12 LTS |
| Jira Service Management Data Center | 11.3.12 LTS |
| Confluence Data Center | 10.2.19 LTS |
| Bitbucket Data Center | 10.2.8 LTS |
| Bamboo Data Center | 12.1.12 LTS |
| Crowd Data Center | 7.2.4 |
| Fisheye and Crucible | 4.9.15 |
For installations on other release branches, Atlassian's vulnerability disclosure portal lists affected versions and available fixes.
Older Server editions present a different problem. Jira, Confluence, and most other Server products stopped receiving security fixes in February 2024, leaving those installations without supported patches. Fisheye and Crucible remain supported until May 2028.
One missed installation can leave a security flaw unresolved
Jira often holds the tickets used to assign and close security work, while Jira Service Management supports IT incident handling and Confluence stores internal response procedures.
Different teams may administer these applications, even when they contain the same vulnerable software component. A completed Jira security ticket can therefore give administrators an incomplete view if an affected Confluence or Crowd installation is still running an older version.
Security leaders should track each affected installation separately in their vulnerability management records. A shared CVE needs to be matched to the actual servers running vulnerable versions, with the responsible product owners confirming each update. Proper patch verification means checking the software version running after deployment before considering the issue resolved. For clustered deployments, verify every node and record the result against the affected installation.
For unsupported Server installations, assign an owner and deadline for migration to a supported platform. Restrict access while migration is pending, and record those controls as temporary risk reduction rather than a completed fix.
A completed patch report offers limited assurance if an older installation used for essential IT work remains vulnerable and outside regular security support.
More cybersecurity news: GitLab administrators face another urgent security update after the company disclosed its second 10.0-rated remote code execution flaw this month.