The Atlassian October 2026 bulletin fixes 162 high-severity and 14 critical-severity third-party vulnerabilities across seven products, Atlassian said when it published the bulletin on 20 October 2026. Every one of the fixes comes from a third-party library each product depends on, not from Atlassian’s own code, Atlassian’s table shows.
The single highest score in the bulletin is CVE-2026-65637, a 9.8 CVSS flaw in the Tomcat Coyote component that Atlassian describes as a man-in-the-middle issue. Atlassian lists it against Confluence Data Center and Crowd Data Center.
What the Atlassian October 2026 Bulletin Covers
Atlassian says the vulnerabilities in this bulletin were found through its bug bounty program, its own pen-testing, and scans of third-party libraries. The bulletin covers Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management.
Atlassian attaches the same note to every critical-rated entry in the bulletin. The CVSS score describes the third-party library on its own, and Atlassian’s own assessment of how its product actually uses that library is a lower, non-critical risk. Atlassian does not publish a replacement score for its own assessment.
The table below lists the fixed version Atlassian recommends for each product. It also lists the worst CVSS score the bulletin gives that product, and whether any of its entries are rated critical. All figures come from Atlassian’s own table, current as of 20 October 2026.
| Product | Fixed version Atlassian recommends | Worst score in this bulletin | Critical-rated entries |
|---|---|---|---|
| Bamboo Data Center and Server | 12.1.12 (LTS) or 10.2.24 (LTS) | 8.7 High | None |
| Bitbucket Data Center and Server | 10.5.1, 10.2.8 (LTS) or 9.4.26 (LTS) | 8.7 High | None |
| Confluence Data Center and Server | 11.0.0, 10.2.19 (LTS) or 9.2.26 (LTS) | 9.8 Critical (CVE-2026-65637) | 5 entries |
| Crowd Data Center and Server | 7.2.4 (LTS) | 9.8 Critical (CVE-2026-65637) | 4 entries |
| Fisheye/Crucible | 4.9.15 | 9.1 Critical (CVE-2026-77185) | 1 entry |
| Jira Software Data Center and Server | 11.3.12 (LTS) or 10.3.26 (LTS) | 9.3 Critical (CVE-2026-58062) | 2 entries |
| Jira Service Management Data Center and Server | 11.3.12 (LTS) or 10.3.26 (LTS) | 9.3 Critical (CVE-2026-58062) | 2 entries |
Patch Order for the Atlassian October 2026 Bulletin
This order follows the CVSS scores Atlassian itself published. Confluence and Crowd carry the bulletin’s two highest scores, 9.8 and 9.3, so they come first. Jira, Jira Service Management and Fisheye/Crucible each carry a 9.1 to 9.3 critical, so they come next. Bamboo and Bitbucket have no critical-rated entry this month, so they come last.
- Inventory your products and versionsCheck which of the seven products you run, and your exact version, from each product’s admin console or About page.
- Patch Confluence and Crowd firstBoth carry CVE-2026-65637, a 9.8 CVSS Tomcat Coyote flaw, the highest score this bulletin lists. Update Confluence to 11.0.0, 10.2.19 (LTS) or 9.2.26 (LTS), and Crowd to 7.2.4 (LTS).
- Patch Jira, Jira Service Management and Fisheye/Crucible nextEach carries a 9.1 to 9.3 critical. Update Jira Software and Jira Service Management to 11.3.12 (LTS) or 10.3.26 (LTS), and Fisheye/Crucible to 4.9.15.
- Patch Bamboo and BitbucketTheir worst entries this month are High, not Critical. Update Bamboo to 12.1.12 (LTS) or 10.2.24 (LTS), and Bitbucket to 10.5.1, 10.2.8 (LTS) or 9.4.26 (LTS).
- Confirm the version after each upgradeOpen the product’s About or System Information page and check the version number against the fixed version you targeted.
- Recheck the Vulnerability Disclosure PortalAtlassian’s bulletin links this portal for the most current fixed versions, since an LTS backport can land after the bulletin’s publication date.
Why Some Long-Term Support Versions Are Missing
Atlassian’s own FAQ in the bulletin explains two reasons a version you run may not appear in the fixed-versions table. The version may be unsupported, so the fix is to patch to the latest version or the current LTS line. Or an LTS release may not have the backport yet, because Atlassian judged it infeasible, per its Security Bug Fix Policy.
Atlassian recommends upgrading to the latest product versions where possible. It also points admins to the release notes linked from the bulletin for the most current fixed versions, since those can change after publication.
What This Bulletin Does Not Tell You
Atlassian’s bulletin does not state whether any of these third-party CVEs have been exploited against an Atlassian product. It gives a CVSS score and a severity word only, with no CVSS vector and no mention of CISA KEV status, so this post does not add either.
For background on the discipline behind this kind of monthly patch cycle, see Brandefense’s patch management and vulnerability management pages. Atlassian has had critical, actively exploited flaws before: see Brandefense’s coverage of CVE-2023-22515, an exploited Confluence zero-day, and the matching CVE-2023-22515 vulnerability page. None of this month’s bulletin entries carry that same confirmed exploitation record.