Threat reportVulnerabilityTL-2026-4216
Atlassian October 2026 Security Bulletin: 176 Flaw Entries in Jira and Confluence (incl. CVE-2026-65637, CVE-2026-58062, CVE-2026-75595) and Actively Exploited CVE-2026-21589
Atlassian October 2026 Security Bulletin (TL-2026-4216), also tracked as Atlassian October 2026 Security Bulletin, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-23. It has no confirmed attribution, affects Atlassian Confluence Data Center and Server, references 7 CVEs (CVE-2026-65637, CVE-2026-58062, CVE-2026-75595), maps to 5 MITRE ATT&CK techniques (T1005, T1078, T1190), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4216
- Threat ID
- TL-2026-4216
- Also known as
- Atlassian October 2026 Security Bulletin
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Atlassian October 2026 Security Bulletin
Malware and tooling: Nuclei CVE-2026-21589 template, watchTowr CVE-2026-21589 scanner/PoC
How Atlassian October 2026 Security Bulletin works
Atlassian's 20 October 2026 bulletin fixes 176 mostly third-party dependency flaws (Tomcat, Bouncy Castle, Netty) across Jira, Confluence, Bamboo, Bitbucket and Crowd. The separate, related Atlassian Data Center file-access flaw CVE-2026-21589 (CVSS 9.3) is exploited in the wild after a public watchTowr PoC and was added to CISA KEV on 2026-10-15.
On October 20, 2026 Atlassian published a security bulletin covering 176 flaw entries (162 high-severity and 14 critical-severity) in third-party libraries bundled with Jira, Jira Service Management, Confluence, Bamboo, Bitbucket and Crowd Data Center/Server products. Atlassian states that critical ratings describe flaws in the outside libraries, with the actual product risk assessed lower than the library scores. The three highest-rated entries cited by press coverage are CVE-2026-65637 (CVSS 9.8, Apache Tomcat; NVD describes it as improper input validation, CWE-20, an incomplete fix for CVE-2026-32990, while the press article labels it a Coyote man-in-the-middle flaw), CVE-2026-58062 (Bouncy Castle: a stapled OCSP response is accepted without being bound to the checked certificate, CWE-295, CVSS v3.1 9.1 / v4.0 9.3) and CVE-2026-75595 (Netty SslClientHelloHandler offset validation bug: a ClientHello header spanning multiple records raises IndexOutOfBoundsException, the default SslContext is selected instead of the SNI-specific one, and per-SNI mutual-TLS enforcement can be bypassed, CWE-754, CVSS 9.1).
Also listed are CVE-2026-65182 (Tomcat: security constraints for longer paths bypass restrictions on shorter sub-paths, CWE-284/CWE-863, CVSS 9.1) and CVE-2026-68525 (Tomcat FORM authentication: constraints restricting POST while permitting GET can be circumvented, CWE-863, CVSS 9.1). Tomcat fixes are 9.0.121, 10.1.58 and 11.0.25. The bulletin article itself documents no active exploitation of these library flaws.
CVE-2026-21589 is a distinct Atlassian-owned vulnerability, disclosed around October 5-6, 2026, that affects eight Data Center products (Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye). A shared web-resource library converts double colons (::) into forward slashes, so a request such as ..::..::..::..::WEB-INF::web.xml becomes a path traversal through plugin resource endpoints. Unauthenticated attackers who know an exact file path can read files from the application root; directory enumeration is not possible. watchTowr Labs showed that reading WEB-INF/classes/crowd.properties exposes plaintext application credentials, which in a Crowd-integrated deployment lead to administrator access to Jira. Exploitation was observed about two hours after the public PoC (October 7, 2026), a Nuclei template followed, and CISA added the CVE to KEV on 2026-10-15 with a federal due date of 2026-10-18. Atlassian reported no trace of exploitation on its cloud instances. Mitigations for those who cannot patch immediately: WAF rules, a Tomcat RewriteValve configuration, or removing the instance from internet exposure.
MITRE ATT&CK techniques used in TL-2026-4216
Collection
Privilege Escalation
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1552.001 Credentials In Files
Reconnaissance
Affected products and versions in Atlassian October 2026 Security Bulletin
- Atlassian — Confluence Data Center and Server
Vulnerable versions: 10.2.0-10.2.18; 9.2.0-9.2.25
Fixed in: 11.0.0; 10.2.19 LTS; 9.2.26 LTS - Atlassian — Jira Software and Jira Service Management Data Center
Vulnerable versions: multiple versions
Fixed in: 10.3.26; 11.3.12; 9.12.40 (Software); 5.12.40 (Service Management) - Atlassian — Bamboo Data Center
Vulnerable versions: multiple versions
Fixed in: 12.1.12 LTS; 10.2.24 LTS - Atlassian — Bitbucket Data Center
Vulnerable versions: multiple versions
Fixed in: 10.5.1; 10.2.8 LTS; 9.4.26 LTS - Atlassian — Crowd Data Center
Vulnerable versions: multiple versions
Fixed in: 6.3.7; 7.0.3; 7.1.7; 7.2.4 - Atlassian — Crucible and Fisheye
Vulnerable versions: before 4.9.15
Fixed in: 4.9.15 - Apache — Tomcat
Vulnerable versions: 9.0.115-9.0.120 (CVE-2026-65637); 10.1.53-10.1.57; 11.0.20-11.0.24
Fixed in: 9.0.121; 10.1.58; 11.0.25 - Bouncy Castle — bc-java / bc-lts-java / bc-fja
Vulnerable versions: bc-java 1.66 to <1.85; bc-lts-java <2.73.12; bc-fja 2.0.0 to <2.0.2 and 2.1.0 to <2.1.3
Fixed in: 1.85; 2.73.12; 2.0.2; 2.1.3 - Netty — Netty
Vulnerable versions: before 4.1.137.Final; 4.2.0.Final-4.2.16.Final
Fixed in: 4.1.137.Final; 4.2.17.Final
Remediation for Atlassian October 2026 Security Bulletin
Patches
- Confluence 11.0.0, 10.2.19 LTS, 9.2.26 LTS
- Jira Software 9.12.40, 10.3.26, 11.3.12; Jira Service Management 5.12.40, 10.3.26, 11.3.12
- Bamboo 12.1.12 LTS, 10.2.24 LTS
- Bitbucket 10.5.1, 10.2.8 LTS, 9.4.26 LTS
- Crowd 6.3.7, 7.0.3, 7.1.7, 7.2.4
- Crucible/Fisheye 4.9.15
- Apache Tomcat 9.0.121, 10.1.58, 11.0.25; Netty 4.1.137.Final, 4.2.17.Final
Immediate actions
- Upgrade Data Center/Server products to the fixed versions listed in the October 20, 2026 Atlassian bulletin
- Prioritize internet-facing instances for CVE-2026-21589 (CISA KEV)
- Rotate credentials stored in WEB-INF/classes/crowd.properties and other application-root config files on exposed instances
- Review web and proxy logs for requests containing '::' traversal sequences against plugin resource endpoints
Workarounds
- Deploy WAF rules blocking '::' path sequences
- Apply a Tomcat RewriteValve configuration
- Temporarily remove instances from internet exposure
Longer-term hardening
- Track third-party library advisories (Tomcat, Netty, Bouncy Castle) for bundled components
- Remove Atlassian admin and Crowd interfaces from direct internet exposure
CVEs associated with Atlassian October 2026 Security Bulletin
CVE-2026-65637, CVE-2026-58062, CVE-2026-75595, CVE-2026-65182, CVE-2026-68525, CVE-2026-21589, CVE-2026-32990
Weaknesses (CWE) in Atlassian October 2026 Security Bulletin
Timeline of Atlassian October 2026 Security Bulletin
- CVE-2026-58062 (Bouncy Castle stapled OCSP binding flaw) published to NVD.
- CVE-2026-75595 (Netty SslClientHelloHandler mTLS bypass) published; fixed in 4.1.137.Final and 4.2.17.Final.
- Apache Tomcat CVE-2026-65637, CVE-2026-65182 and CVE-2026-68525 published; fixes in 9.0.121, 10.1.58, 11.0.25.
- Atlassian warned of CVE-2026-21589 and watchTowr Labs published a technical analysis and PoC showing '::' path traversal and crowd.properties exposure.
- Exploitation attempts detected roughly two hours after the public PoC; a Nuclei template followed.
- CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities catalog.
- CISA remediation deadline for U.S. federal agencies for CVE-2026-21589.
- Atlassian published its security bulletin covering 176 flaw entries (14 critical, 162 high) across Jira, Confluence, Bamboo, Bitbucket and Crowd.
- Cyber Security News reported the bulletin, highlighting CVE-2026-65637, CVE-2026-58062 and CVE-2026-75595.
Sources cited for Atlassian October 2026 Security Bulletin
- Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and Confluence
- NVD - CVE-2026-65637
- NVD - CVE-2026-58062
- Bouncy Castle CVE-2026-58062 wiki
- NVD - CVE-2026-75595
- Netty GHSA-c4c3-7fpv-j4q5
- NVD - CVE-2026-65182
- NVD - CVE-2026-68525
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-21589)
- U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog
- Hackers exploit critical Atlassian flaw after public PoC release
- Atlassian CVE-2026-21589: critical flaw in Jira, Confluence, Bitbucket
Detection coverage for TL-2026-4216
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4216 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.