Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager

Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated release addresses critical and high-severity vulnerabilities, including flaws found through AI-assisted security testing. The company said customers should address internet-facing devices first.

In an October 21 announcement, Fortinet Chief Information Security Officer Carl Windsor warned customers against treating these fixes as routine maintenance. The update follows security releases for FortiMail and FortiAuthenticator, extending the patching effort across several key products.

Affected Versions and Required Updates

FortiOS customers should move to version 8.0.2, 7.6.8, 7.4.13, or 7.2.14, depending on their current branch. Affected releases span 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12, and 7.2.0–7.2.13.

FortiManager and FortiAnalyzer share the same minimum fixed releases: 8.0.2, 7.6.8, 7.4.12, and 7.2.13. Their affected versions cover 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11, and 7.2.0–7.2.12. Fortinet lists October 22 availability for all these updates.

For FortiMail, the fixed versions are 8.0.2, 7.6.7, and 7.4.9. Customers running affected FortiMail 7.2 releases must move to the 7.4 branch or later. FortiAuthenticator users should install 8.0.4 or 6.6.11, depending on their branch.

Product	Release Branch	Affected Versions	Patched Version or Required Upgrade
FortiOS	8.0	8.0.0–8.0.1	8.0.2 or later
FortiOS	7.6	7.6.0–7.6.7	7.6.8 or later
FortiOS	7.4	7.4.0–7.4.12	7.4.13 or later
FortiOS	7.2	7.2.0–7.2.13	7.2.14 or later
FortiManager	8.0	8.0.0–8.0.1	8.0.2 or later
FortiManager	7.6	7.6.0–7.6.7	7.6.8 or later
FortiManager	7.4	7.4.0–7.4.11	7.4.12 or later
FortiManager	7.2	7.2.0–7.2.12	7.2.13 or later
FortiAnalyzer	8.0	8.0.0–8.0.1	8.0.2 or later
FortiAnalyzer	7.6	7.6.0–7.6.7	7.6.8 or later
FortiAnalyzer	7.4	7.4.0–7.4.11	7.4.12 or later
FortiAnalyzer	7.2	7.2.0–7.2.12	7.2.13 or later
FortiMail	8.0	8.0.0–8.0.1	8.0.2 or later
FortiMail	7.6	7.6.0–7.6.6	7.6.7 or later
FortiMail	7.4	7.4.0–7.4.8	7.4.9 or later
FortiMail	7.2	7.2.0–7.2.9	Upgrade to the 7.4 branch or later
FortiAuthenticator	8.0	8.0.0–8.0.3	8.0.4 or later
FortiAuthenticator	6.6	6.6.0–6.6.10	6.6.11 or later

Fortinet plans to publish public advisories on its PSIRT page on November 10. Its notice says FortiSASE will receive automatic updates before the coordinated release. FortiManager Cloud updates may require manual action, while public cloud updates follow the relevant cloud provider’s release process.

Atlassian has shared its security bulletin for October 2026. It has 176 flaw entries for products like Jira, Confluence, Bamboo, Bitbucket, and Crowd. The update released on October 20 shows 162 high-severity issues and 14 critical third-party problems. Atlassian says it added fixes in product versions from last month and tells customers to install a proper fixed version.

Confluence includes two improper authorization vulnerabilities, CVE-2026-65182 and CVE-2026-68525, affecting the Apache Tomcat Catalina dependency. Atlassian clarified that critical severity ratings associated with certain third-party libraries do not necessarily indicate an equivalent critical risk in Atlassian products themselves.

For Confluence Data Center, fixed releases include 11.0.0, 10.2.19 LTS, and 9.2.26 LTS, with 10.2.19 LTS recommended. Bamboo customers are advised to upgrade to 12.1.12 LTS or 10.2.24 LTS, while Bitbucket fixes include 10.5.1, 10.2.8 LTS, and 9.4.26 LTS.

Jira administrators should also review a separate security advisory addressing CVE-2026-21589, which concerns arbitrary file access and has its own affected-product and fixed-version details.

Atlassian suggests updating affected products to the newest versions. Admins need to check their installed builds with the official security updates and release notes since the fixes and product availability differ by release and type.