# Atlassian October 2026 Security Bulletin: 176 Flaw Entries in Jira and Confluence (incl. CVE-2026-65637, CVE-2026-58062, CVE-2026-75595) and Actively Exploited CVE-2026-21589

> Atlassian's 20 October 2026 bulletin fixes 176 mostly third-party dependency flaws (Tomcat, Bouncy Castle, Netty) across Jira, Confluence, Bamboo, Bitbucket and Crowd. The separate, related Atlassian Data Center file-access flaw CVE-2026-21589 (CVSS 9.3) is exploited in the wild after a public watchTowr PoC and was added to CISA KEV on 2026-10-15.

- **Published:** 2026-10-23T03:59:39Z
- **Last reviewed:** 2026-10-23T03:59:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4216
- **ID:** TL-2026-4216
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-65637, CVE-2026-58062, CVE-2026-75595, CVE-2026-65182, CVE-2026-68525, CVE-2026-21589, CVE-2026-32990

## Description

On October 20, 2026 Atlassian published a security bulletin covering 176 flaw entries (162 high-severity and 14 critical-severity) in third-party libraries bundled with Jira, Jira Service Management, Confluence, Bamboo, Bitbucket and Crowd Data Center/Server products. Atlassian states that critical ratings describe flaws in the outside libraries, with the actual product risk assessed lower than the library scores. The three highest-rated entries cited by press coverage are CVE-2026-65637 (CVSS 9.8, Apache Tomcat; NVD describes it as improper input validation, CWE-20, an incomplete fix for CVE-2026-32990, while the press article labels it a Coyote man-in-the-middle flaw), CVE-2026-58062 (Bouncy Castle: a stapled OCSP response is accepted without being bound to the checked certificate, CWE-295, CVSS v3.1 9.1 / v4.0 9.3) and CVE-2026-75595 (Netty SslClientHelloHandler offset validation bug: a ClientHello header spanning multiple records raises IndexOutOfBoundsException, the default SslContext is selected instead of the SNI-specific one, and per-SNI mutual-TLS enforcement can be bypassed, CWE-754, CVSS 9.1).

Also listed are CVE-2026-65182 (Tomcat: security constraints for longer paths bypass restrictions on shorter sub-paths, CWE-284/CWE-863, CVSS 9.1) and CVE-2026-68525 (Tomcat FORM authentication: constraints restricting POST while permitting GET can be circumvented, CWE-863, CVSS 9.1). Tomcat fixes are 9.0.121, 10.1.58 and 11.0.25. The bulletin article itself documents no active exploitation of these library flaws.

CVE-2026-21589 is a distinct Atlassian-owned vulnerability, disclosed around October 5-6, 2026, that affects eight Data Center products (Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye). A shared web-resource library converts double colons (::) into forward slashes, so a request such as ..::..::..::..::WEB-INF::web.xml becomes a path traversal through plugin resource endpoints. Unauthenticated attackers who know an exact file path can read files from the application root; directory enumeration is not possible. watchTowr Labs showed that reading WEB-INF/classes/crowd.properties exposes plaintext application credentials, which in a Crowd-integrated deployment lead to administrator access to Jira. Exploitation was observed about two hours after the public PoC (October 7, 2026), a Nuclei template followed, and CISA added the CVE to KEV on 2026-10-15 with a federal due date of 2026-10-18. Atlassian reported no trace of exploitation on its cloud instances. Mitigations for those who cannot patch immediately: WAF rules, a Tomcat RewriteValve configuration, or removing the instance from internet exposure.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1078 Valid Accounts

## Sources

- [Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and Confluence](https://cybersecuritynews.com/atlassian-security-update/)
- [NVD - CVE-2026-65637](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-65637)
- [NVD - CVE-2026-58062](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-58062)
- [Bouncy Castle CVE-2026-58062 wiki](https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058062)
- [NVD - CVE-2026-75595](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-75595)
- [Netty GHSA-c4c3-7fpv-j4q5](https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5)
- [NVD - CVE-2026-65182](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-65182)
- [NVD - CVE-2026-68525](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-68525)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-21589)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/?p=201086)
- [Hackers exploit critical Atlassian flaw after public PoC release](https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-atlassian-flaw-after-public-poc-release/)
- [Atlassian CVE-2026-21589: critical flaw in Jira, Confluence, Bitbucket](https://www.it-connect.fr/atlassian-cve-2026-21589-faille-critique-jira-confluence-bitbucket/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4216