CVE-2026-65637

Atlassian October Security Bulletin Flags 176 Third-Party Library Vulnerabilities Across Jira, Confluence and Bitbucket

Atlassian released its October security bulletin detailing 176 vulnerability entries distributed across seven products including Jira, Confluence, Bamboo, Bitbucket, Crowd, Fisheye and Crucible. Of these, 162 entries carry high severity and 14 are rated critical, though the total does not represent 176 unique flaws because the same identifiers recur when multiple products share the same third-party library. All critical issues originate in external components rather than Atlassian code, with the most severe being CVE-2026-65637 in the Coyote component of Apache Tomcat used by Confluence, which allows interception of server-client connections. Affected versions and corresponding fixes were published for Confluence Data Center, Bamboo, Bitbucket Data Center, Jira Software and Jira Service Management, with the company stressing that administrators must compare exact build numbers against the full corrected-version table. No exploitation of the listed issues had been reported as of 22 October, and Atlassian classifies the inherited exposure from third-party libraries as lower priority, issuing separate critical alerts only for immediate-risk cases.

Multiple Vulnerabilities Found in Apache Tomcat, Four Rated Critical by CISA

Apache Tomcat has received updates addressing 11 vulnerabilities across versions 11.0.25, 10.1.59, and 9.0.121. The Apache Software Foundation rated four issues as Important, while CISA assigned Critical severity to four CVEs based on CVSS v3.1 scores reaching 9.8. The flaws include authentication bypasses, access control evasion due to path evaluation order, off-by-one errors, and HTTP/2 resource leaks leading to denial of service. One vulnerability was disclosed earlier in July, with the remaining ten detailed on August 25. Moderate and Low severity issues were also patched in the same releases. The discrepancies in severity ratings between the vendor and CISA highlight differing risk assessments for the same CVEs.