Atlassian released a large set of security updates for many of its self-hosted products, including Jira, Confluence, Bitbucket, Bamboo, Crowd, Fisheye/Crucible, and Jira Service Management. The fixes cover dozens of third-party dependency vulnerabilities across about 100 bulletins, including critical flaws in Axios (CVE-2026-42043, CVE-2026-40175, CVE-2026-42264), Apache Tomcat (including CVE-2026-41293, CVE-2026-43512, CVE-2026-43515), and Netty (CVE-2026-42584).
Why it matters: Organizations running Atlassian server and data center products may be exposed through bundled components they do not directly track, so administrators should apply the relevant product updates promptly. The story matters because these tools are widely used for code hosting, ticketing, documentation, and internal collaboration.
Bill Toulas
2026.10.07
97% relevant
This updates the same underlying event around CVE-2026-21589 in Atlassian Data Center products by adding that exploitation attempts began within hours of public technical details and proof-of-concept release, with honeypot evidence, attacker IPs, and concrete post-disclosure risk escalation.
Ionut Arghire
2026.08.20
93% relevant
This is a direct update on the same Atlassian patch event, adding that Atlassian fixed 10 critical and 162 high-severity issues affecting Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira, covering about 109 unique CVEs mostly in third-party dependencies.
Ionut Arghire
2026.06.18
100% relevant
This article is the first item here establishing Atlassian's June 18, 2026 wave of dependency-driven security bulletins across multiple core products.
← Back to all stories