Atlassian Security Update Lists 176 Flaw Entries Across Jira, Confluence and Other Products

Atlassian released a security bulletin listing 176 flaw entries across Jira, Confluence, Bamboo, Bitbucket and Crowd, including 162 high-severity entries and 14 critical-severity third-party entries. The count includes CVEs repeated across products with shared dependencies, not 176 unique vulnerabilities. Notable dependency findings involve Apache Tomcat Coyote, Bouncy Castle and Netty; Atlassian assesses the risk from its use of the critically rated libraries as non-critical. The supplied reporting provides no evidence of exploitation of these findings.

The Canadian Centre for Cyber Security reinforced the update guidance in advisory AV26-1076, identifying affected products that also include Fisheye/Crucible, Jira Service Management, and Jira Data Center and Server. Its notice lists some affected version ranges but does not provide CVE identifiers, technical impacts, severity ratings or exploitation details. Administrators should inventory installed Atlassian products, compare their versions against the vendor’s fixed-version tables and release notes, and upgrade affected deployments to appropriate patched releases.