Zaifliklar
Atlassian Data Center va Server mahsulotlaridagi 75 ta zaiflikni tuzatdi
Atlassian’ning oktyabr byulletenida 176 ta zaiflik yozuvi ro‘yxatga olingan, jumladan 14 ta tanqidiy darajadagi muammo — barchasi uchinchi tomon komponentlarida.
Muallif
Eduard Kovacs
| 23-oktabr, 2026 (ET bo‘yicha 3:54)
Atlassian seshanba kuni 2026-yil oktyabr oyi xavfsizlik byulletenini e’lon qildi, unda 162 ta yuqori darajadagi va 14 ta tanqidiy darajadagi zaiflik ro‘yxatga olingan.
Barcha yozuvlar uchinchi tomon bog‘liqliklari bilan bog‘liq va ko‘plab CVE’lar bir nechta mahsulot ostida paydo bo‘ladi. SecurityWeek hisob-kitobiga ko‘ra, byulleten 75 ta noyob CVE’ni qamrab oladi, ulardan oltitasi tanqidiy deb baholangan.
Ta’sirlangan mahsulotlar: Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software va Jira Service Management.
Tanqidiy darajadagi zaifliklar:
- CVE-2026-65637, CVE-2026-65182 va CVE-2026-68525 — Confluence va Crowd uchun ro‘yxatga olingan Apache Tomcat muammolari.
- CVE-2026-58062 — Confluence, Crowd, Jira Software va Jira Service Management uchun ro‘yxatga olingan Bouncy Castle muammosi.
- CVE-2026-75595 — Confluence, Jira Software va Jira Service Management uchun ro‘yxatga olingan Netty muammosi.
- CVE-2026-77185 — Fisheye/Crucible uchun ro‘yxatga olingan Apache SSHD muammosi.
Har biri uchun Atlassian ta’kidlashicha, ta’sirlangan komponentdan foydalanish “pastroq, tanqidiy bo‘lmagan baholangan xavfni” keltirib chiqaradi.
Atlassian’ning zaifliklarni oshkor qilish portali shuningdek, 20-oktabrda oshkor qilingan muammolar orasida Data Center va Crowd’ga ta’sir qiluvchi tanqidiy darajadagi Apache Tomcat zaifligi CVE-2026-65905 ni ham ro‘yxatga olgan. Biroq bu CVE byulletenida ko‘rinmaydi va portal byulletenga nisbatan kamroq noyob CVE’larni ro‘yxatga oladi.
Qolgan yuqori darajadagi zaifliklar keng tarqalgan ochiq manbali kutubxonalarga ta’sir qiladi, jumladan Apache Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts va Apache ActiveMQ.
Reklama. O‘qishni davom ettirish uchun pastga aylantiring.
Ularning ko‘pchiligi xizmatdan voz kechish (DoS) muammolari. Boshqalari kriptografik zaifliklar, autentifikatsiya va avtorizatsiya muammolari, server tomonidagi so‘rov soxtalashtirish (SSRF), ma’lumot oshkor qilish va kod bajarish xatolari sifatida tasvirlangan.
“Xavfsizlik byulletenlarida har oy e’lon qilingan CVE’lar Atlassian mijozlari uchun tanqidiy bo‘lmagan xavfni keltirib chiqaradi,” deb ta’kidlaydi kompaniya.
Atlassian bu zaifliklardan birortasi hujumlarda ishlatilayotgani haqida hech narsa aytmaydi. U eng so‘nggi mahsulot versiyalariga yoki byulletenida ko‘rsatilgan tuzatilgan relizlarga yangilashni tavsiya qiladi.
Tashkilotlar Atlassian mahsulotlarini doimo yangilab turishlari kerak, chunki tahdid qiluvchilar zaifliklardan tez-tez foydalanadilar. Bunga misol — CVE-2026-21589, Atlassian’ning o‘z-o‘zini joylashtirgan Data Center mahsulotlaridagi tanqidiy zaiflik, hujumchilar PoC e’lon qilinganidan bir necha soat o‘tib nishonga olishni boshlagan.
Bog‘liq: Atlassian 8 ta mahsulotga ta’sir qiluvchi tanqidiy zaiflikni tuzatdi
Bog‘liq: Atlassian’ning Rovo AI’dagi tanqidiy bir bosish bilan ishlaydigan zaiflik korporativ ma’lumotlarni fosh qildi
Bog‘liq: Atlassian, Splunk o‘nlab tanqidiy va yuqori darajadagi zaifliklarni tuzatdi
Muallif: Eduard Kovacs
Eduard Kovacs (@EduardKovacs) SecurityWeek’ning katta boshqaruvchi muharriri. U jurnalistika sohasiga 2011-yilda o‘rta maktab IT o‘qituvchisi sifatida ishlaganidan so‘ng kirgan. Eduard sanoat informatikasi bo‘yicha bakalavr darajasiga va elektr muhandisligida qo‘llaniladigan kompyuter texnikalari bo‘yicha magistr darajasiga ega.
Kundalik axborot byulleteni
So‘nggi kiberxavfsizlik tahdidlari, tendensiyalar va mutaxassis fikrlari haqida xabardor bo‘lish uchun SecurityWeek elektron pochta axborotiga obuna bo‘ling.
Biznes elektron pochta*
emailsignupsource
Qo‘shimcha ma’lumot uchun Maxfiylik siyosatimizni o‘qing.
Eduard Kovacsdan ko‘proq
- Eronning Fors shahzodasi APT 2016-yildan beri birinchi marta AQShda C&C joylashtirdi
- Texnologiya va xavfsizlik kompaniyalari PHP2Shell zaifliklariga javob qaytardi
- Oracle 2026-yil oktyabr CPU bilan 1200 dan ortiq zaiflikni tuzatdi
- Google Chrome’ni ClickFix hujumlari va xavfsiz bo‘lmagan HTTP ulanishlariga qarshi mustahkamladi
- OpenAI agentlari xavfsizlik jamoasi ogohlantirishlarini o‘chirib qo‘ydi, mos kelmaslik monitorini olib tashladi
- Buzilgan dasturchi hisobi OVHcloud CLI’da o‘g‘rilikni joylashtirish uchun ishlatildi
- Accenture, Dragos, SANS kichik AQSh kommunal xizmatlarini himoya qilish uchun 10 million dollarlik tashabbusni ishga tushirdi
- Microsoft dinamik ruxsatlar va xavf baholashi bilan noto‘g‘ri AI agentlarini nishonga oldi
So‘nggi yangiliklar
- Sobiq 8200-bo‘linma ofitserlari agentik SecOps startapi Mave uchun 34 million dollar yig‘di
- Boshqa yangiliklarda: Tor chiqish releylari buzildi, banklar noto‘g‘ri AI agentlarini aniqladi, o‘z-o‘zini qayta quradigan macOS ransomware
- Mirai botnet operatorlari PHP2Shell hujumlariga qo‘shildi, ASLR aylanib o‘tish ekspluatlari paydo bo‘ldi
- Xitoy APT ConnectWise hujumlarida AI pentest vositasi Artex’dan foydalandi
- Hujumchilar to‘rt oy ichida uchinchi Arista VCO nol kunlik zaifligini ekspluatatsiya qildi
- Capcom ma’lumotlar buzilishi 11 million kishiga ta’sir qildi
- Quest Diagnostics ma’lumotlar buzilishi “ayrim bemor yozuvlari”ni fosh qildi
- LiteLLM yangi ta’minot zanjiri hujumida buzildi
Trend
Capcom ma’lumotlar buzilishi 11 million kishiga ta’sir qildi
Eronning Fors shahzodasi APT 2016-yildan beri birinchi marta AQShda C&C joylashtirdi
PHP2Shell: Ochiq tanqidiy PHP zaifliklari uchun ommaviy ekspluatatsiya yaqinlashmoqda
PHP2Shell tuzatishlari birinchi ekspluatatsiya urinishlari sensorlarga urilganda paydo bo‘ldi
PHP2Shell ekspluatatsiyasi tuzatishlardan bir necha kun oldin boshlandi
Quest Diagnostics ma’lumotlar buzilishi “ayrim bemor yozuvlari”ni fosh qildi
Xitoy APT ConnectWise hujumlarida AI pentest vositasi Artex’dan foydalandi
Boshqa yangiliklarda: Tor chiqish releylari buzildi, banklar noto‘g‘ri AI agentlarini aniqladi, o‘z-o‘zini qayta quradigan macOS ransomware
Kundalik axborot byulleteni
So‘nggi tahdidlar, tendensiyalar va texnologiyalar haqida xabardor bo‘lish, shuningdek, soha mutaxassislarining chuqur fikrlarini olish uchun SecurityWeek elektron pochta axborotiga obuna bo‘ling.
Biznes elektron pochta*
emailsignupsource
Qo‘shimcha ma’lumot uchun Maxfiylik siyosatimizni o‘qing.
Vebinar: Sizning Google Workspace’dagi AI kirish xavfi allaqachon mavjud
19-oktabr, 2026
Google Workspace’ga ulangan AI vositalari millionlab nozik elektron pochta va fayllarga kirishi mumkin. Tashkilotingizning xavfini aniqlash va AI kirishini boshqarish tizimini o‘rganish uchun ushbu sessiyaga qo‘shiling.
Ro‘yxatdan o‘ting
Virtual tadbir: CISO Forum 2026 Summit
10 va 11-noyabr, 2026
CISO’lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik yetakchilarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiruvchi masalalarni ko‘rib chiqish uchun birlashtiramiz.
Ro‘yxatdan o‘ting
Harakatdagi odamlar
Cequence Security Russ Schaferni CMO etib tayinladi.
Mona Harrington DHS’ning Kiber integratsiya bo‘yicha yordamchi direktori etib tayinlandi.
iCOUNTER Mark H. FitzPatrickni CFO etib tayinladi.
Harakatdagi ko‘proq odamlar
Mutaxassis fikrlari
Zamonaviy AI dasturiy ta’minot xavfsizligining kaliti tezlik emas, balki yetuklik
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta’sir qiladi. (Matias Madou)
Zamonaviy kiberhujumlarga qarshi kurashda kontekst qirol
Kontekstual himoya xavfsizlik jamoalariga signallarni bog‘lash, keyingisini oldindan bilish va tahdidlar kuchayishidan oldin ularni to‘xtatishga yordam beradi. (Etay Maor)
AI hujum tezligini o‘zgartirdi, xavfsizlik asoslarini emas
AI zaifliklarni aniqlash va ekspluatatsiya qilishni tezlashtirgan sari, “virtual tuzatish” hali ham chuqur himoya va kuchli ilova xavfsizligi asoslariga bog‘liq. (Joshua Goldfarb)
Kelajak uchun katta rejalar tuzgan to‘rtta kiber tahdid
- AI, ta’minot zanjiri ta’siri, kvant hisoblash va geosiyosiy ziddiyat xavfsizlik dasturlarini sinovdan o‘tkazmoqda. Buzilishlarga tayyorgarlik kundalik operatsiyalarning bir qismiga aylanishi kerak. (Steve Durbin)
Oxiridan boshlang: Agentik tuzatishni qanday yoqish mumkin
Agentik tuzatish ishonch harakati emas. Biz ma’lum muammolarni tuzatish haqida gapiryapmiz, notanish xavf haqida hukm chiqarish emas. (Nadir Izrael)
Vulnerabilities
Atlassian Patches 75 Flaws in Data Center and Server Products
Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.
By
Eduard Kovacs
| October 23, 2026 (3:54 AM ET)
*
Atlassian on Tuesday published its October 2026 security bulletin, which lists 162 high-severity and 14 critical-severity vulnerabilities.
All of the entries are tied to third-party dependencies, and many CVEs appear under several products. By SecurityWeek’s count, the bulletin covers 75 unique CVEs, six of them rated critical.
The affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management.
The critical-severity flaws are:
- CVE-2026-65637, CVE-2026-65182, and CVE-2026-68525 – Apache Tomcat issues listed for Confluence and Crowd.
- CVE-2026-58062 – a Bouncy Castle issue listed for Confluence, Crowd, Jira Software, and Jira Service Management.
- CVE-2026-75595 – a Netty issue listed for Confluence, Jira Software, and Jira Service Management.
- CVE-2026-77185 – an Apache SSHD issue listed for Fisheye/Crucible.
For each of these, Atlassian notes that its use of the affected component “presents a lower, non-critical assessed risk.”
Atlassian’s vulnerability disclosure portal also lists CVE-2026-65905, a critical-severity Apache Tomcat flaw affecting Data Center and Crowd, among the issues disclosed on October 20. However, the CVE doesn’t appear in the bulletin, and the portal lists fewer unique CVEs than the bulletin does.
The remaining high-severity flaws affect widely used open source libraries, including Apache Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Apache Struts, and Apache ActiveMQ.
Advertisement. Scroll to continue reading.
Many of them are denial-of-service (DoS) issues. Others are described as cryptographic weaknesses, authentication and authorization problems, server-side request forgery (SSRF), information disclosure, and code execution bugs.
“CVEs reported in monthly Security Bulletins have been assessed as presenting a non-critical risk to Atlassian customers,” the company says.
Atlassian makes no mention of any of these vulnerabilities being exploited in attacks. It recommends updating to the latest product versions or to the fixed releases listed in the bulletin.
Organizations should keep their Atlassian products up to date, as threat actors often quickly exploit vulnerabilities. One example is CVE-2026-21589, a critical flaw in Atlassian’s self-hosted Data Center products that attackers began targeting within hours of a PoC being published.
Related: Atlassian Patches Critical Vulnerability Affecting 8 Products
Related: Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data
Related: Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities
Written ByEduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Eduard Kovacs
- Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
- Tech and Security Companies Respond to PHP2Shell Vulnerabilities
- Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
- Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
- OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
- Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
- Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities
- Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
Latest News
- Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
- In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
- Attackers Exploit Third Arista VCO Zero-Day in Four Months
- 11 Million Impacted by Capcom Data Breach
- Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
- LiteLLM Compromised in Fresh Supply Chain Attack
Trending
11 Million Impacted by Capcom Data Breach
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
PHP2Shell Exploitation Started Days Before Patches
Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The Move
Expert Insights
*
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)
Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.(Nadir Izrael)