The critical-severity flaws include CVE-2026-65637, CVE-2026-65182, CVE-2026-68525, CVE-2026-58062, and CVE-2026-77185, affecting Apache Tomcat, Bouncy Castle, Netty, and Apache SSHD components.
The vulnerability or weakness
The critical-severity flaws include CVE-2026-65637, CVE-2026-65182, CVE-2026-68525, CVE-2026-58062, and CVE-2026-77185, affecting Apache Tomcat, Bouncy Castle, Netty, and Apache SSHD components.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-21589 | 9.3 | CRITICAL | Yes, added 2026-10-15 | 2026-10-18 |
| CVE-2026-58062 | 9.3 | CRITICAL | No | - |
| CVE-2026-65182 | 9.1 | CRITICAL | No | - |
| CVE-2026-65637 | 9.8 | CRITICAL | No | - |
| CVE-2026-65905 | 9.8 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Cisco Patches 34 Vulnerabilities Across Multiple Products (2026-10-22)
- Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security (2026-10-21)
Business impact
Organizations using Atlassian’s Data Center and Server products face potential risks, though Atlassian notes a lower, non-critical assessed risk for its use of the affected components.
Industries affected
The vulnerabilities impact a wide range of industries, including enterprise software, IT infrastructure, and service management.
Users affected
Atlassian’s users, particularly those running self-hosted Data Center products, should update to the latest versions to mitigate potential risks.
