Atlassian's October Patch Drop: Six Critical Flaws, One Already Under Active Attack
Atlassian's monthly security bulletin for October 2026 lists 176 vulnerabilities across its suite of project-management tools. One flaw in a separate advisory is already being exploited in the wild, with US federal agencies given just three days to patch.
Key points
- CISA added CVE-2026-21589, an Atlassian Data Center file-exposure flaw, to its Known Exploited Vulnerabilities catalogue on 2026-10-15, giving US federal agencies until 2026-10-18 to patch.
- Atlassian's October 20, 2026 security bulletin covers 162 high-severity and 14 critical-severity vulnerabilities across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.
- Three of the six critical flaws are Apache Tomcat bugs rated 9.8 and 9.1 out of 10, affecting Confluence and Crowd installations.
- Atlassian says none of the bulletin vulnerabilities are currently being exploited, but separately disclosed CVE-2026-21589 is already under active attack.
- All fixes are available now; Atlassian recommends updating to the latest release of each product.
Atlassian publishes a security bulletin on a monthly schedule, and the October 2026 edition is one of its heavier ones: 176 vulnerabilities in total, covering the company's self-hosted "Data Center" and "Server" editions of tools that millions of software teams use every day for managing projects, storing documentation, and writing code.
Every single entry in the bulletin is tied to a third-party library, meaning a piece of outside software that Atlassian's own products depend on, rather than a flaw in Atlassian's own code. That distinction matters for how companies prioritise patching, but it does not reduce the real-world risk to anyone running an unpatched server.
What are the most serious flaws?
Three Apache Tomcat bugs sit at the top of the severity list. Apache Tomcat is the software engine that runs underneath many web applications; a flaw there can affect everything built on top of it.
CVE-2026-65637 carries a score of 9.8 out of 10 and affects Tomcat versions 9.0.115 to 9.0.120, 10.1.53 to 10.1.57, and 11.0.20 to 11.0.24. It is an input-validation failure, meaning the software does not properly check data it receives before acting on it, and was published on 2026-08-25. The fix lands in versions 9.0.121, 10.1.58, and 11.0.25.
CVE-2026-65182 and CVE-2026-68525 both score 9.1 and were also published on 2026-08-25. Each allows an attacker to bypass access controls, meaning someone without permission could reach parts of a system they should never see. CVE-2026-65182 stretches back to Tomcat 7.0.0. The same trio of updated versions fixes both.
| CVE | CVSS | What it allows | Fixed in |
|---|---|---|---|
| CVE-2026-65637 | 9.8 | Input-validation bypass | Tomcat 9.0.121 / 10.1.58 / 11.0.25 |
| CVE-2026-65182 | 9.1 | Security-constraint bypass | Tomcat 9.0.121 / 10.1.58 / 11.0.25 |
| CVE-2026-68525 | 9.1 | Auth bypass via FORM login | Tomcat 9.0.121 / 10.1.58 / 11.0.25 |
| CVE-2026-21589 | Critical | File exposure, no login needed | Federal deadline: 2026-10-18 |
Atlassian's own assessment is that its specific use of the Tomcat component "presents a lower, non-critical assessed risk." That caveat appears throughout the bulletin, and it reflects how the company actually deploys the library, not the raw score assigned to the flaw itself.
Should Atlassian customers be worried about active attacks?
For the bulletin vulnerabilities, Atlassian says no exploitation has been observed. The more pressing concern is CVE-2026-21589, which sits outside the bulletin but is very much part of the same story.
That flaw lets an unauthenticated attacker, meaning someone with no account at all, read specific files inside the web application directory on self-hosted Atlassian Data Center products including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. CISA, the US Cybersecurity and Infrastructure Security Agency, added it to its Known Exploited Vulnerabilities catalogue on 2026-10-15 and required all US federal agencies to patch by 2026-10-18, a window of just three days. Speed like that signals active, ongoing exploitation.
The pattern is the real story here. Atlassian products running on private servers have become a reliable target. Criminals watch for new proofs-of-concept, working demonstrations that show how a flaw can be used, and move fast once one appears.
If your organisation runs any Atlassian self-hosted product, check with whoever manages your servers that the October updates have been applied. If you use Atlassian's cloud versions, the company handles patching on your behalf.
Common questions
Does this affect me if I use Atlassian's cloud products?
No. This bulletin and CVE-2026-21589 apply only to self-hosted "Data Center" and "Server" editions. Atlassian patches its own cloud infrastructure independently.
How do I know if my company's servers are patched?
Ask your IT or infrastructure team to confirm the installed version of each Atlassian product against the fixed versions listed in the October 2026 security bulletin. If they are running anything older than the fixed releases, patching should happen immediately.
