Atlassian released a large set of security updates for many of its self-hosted products, including Jira, Confluence, Bitbucket, Bamboo, Crowd, Fisheye/Crucible, and Jira Service Management. The fixes cover dozens of third-party dependency vulnerabilities across about 100 bulletins, including critical flaws in Axios (CVE-2026-42043, CVE-2026-40175, CVE-2026-42264), Apache Tomcat (including CVE-2026-41293, CVE-2026-43512, CVE-2026-43515), and Netty (CVE-2026-42584).
Why it matters: Organizations running Atlassian server and data center products may be exposed through bundled components they do not directly track, so administrators should apply the relevant product updates promptly. The story matters because these tools are widely used for code hosting, ticketing, documentation, and internal collaboration.
Ionut Arghire
2026.06.18
100% relevant
This article is the first item here establishing Atlassian's June 18, 2026 wave of dependency-driven security bulletins across multiple core products.
← Back to all stories