Atlassian Patches 161 Vulnerabilities Across Enterprise DevOps and CI/CD Platforms

Atlassian released its September 2026 Security Bulletin, detailing fixes for 161 vulnerabilities across its self-hosted enterprise suite, spanning 144 high-severity flaws and 17 critical-severity third-party dependencies. The updates impact enterprise developer tooling, notably Bamboo Data Center and Server as well as Bitbucket Data Center. Among the most significant resolved issues is CVE-2026-75595, a CVSS 9.1 critical remote code execution vulnerability residing in the io.netty dependency within Bamboo Data Center, alongside denial-of-service flaws like CVE-2026-54512 in jackson-databind. Atlassian has urged customers running affected long-term support (LTS) and standard versions to update to designated patched builds immediately. This release highlights a persistent vulnerability vector: the internal build, orchestration, and continuous integration infrastructure used by engineering organizations. When CI/CD servers like Bamboo or repository management platforms like Bitbucket harbor remote code execution vectors or unpatched networking libraries, they expose the entire software supply chain to compromise. An attacker compromising a build coordinator or runner can inject malicious logic into upstream artifacts, exfiltrate deployment credentials, or pivot deeper into cloud production networks. DevSecOps teams responsible for platform engineering and continuous delivery security must prioritize patching these systems with the same urgency applied to internet-facing production applications. The broader context reflects an escalating focus on CI/CD pipeline integrity and dependency management across the DevSecOps ecosystem. As enterprises adopt comprehensive Software Bill of Materials (SBOM) generation and automated code scanning, third-party and transitive library vulnerabilities inside the DevOps platforms themselves remain an operational blind spot. Security teams frequently scan source code repositories while neglecting the operational patching cycles of the underlying CI runners, artifact caches, and build orchestrators that execute those workflows. In practice, infrastructure and security engineering teams should audit their self-hosted Atlassian Data Center deployments and plan immediate upgrades to the latest LTS releases (such as Bamboo 12.1.11 or 10.2.23). Beyond patching, DevSecOps teams should enforce network isolation around build agents, restrict agent-to-master communication pathways, and use short-lived credentials for all CI/CD workflows to minimize blast radius should an unpatched dependency be targeted.