Atlassian and Splunk Patch More Than 250 Vulnerabilities in Their Products

Two Update Campaigns Focused on Dependencies

Atlassian and Splunk released security updates this week addressing more than 250 vulnerabilities combined. The news was reported on August 20, 2026.

The fixes affect platforms used for software development, collaboration, incident management, and log analysis. Many of the flaws are not in the vendors’ own code, but in third-party libraries and components integrated into their products.

Potential consequences vary depending on the vulnerability and system configuration. They include remote code execution, denial-of-service, information theft, man-in-the-middle attacks, authentication bypass, and server-side request forgery involving requests to internal resources.

No active exploitation campaigns linked to these specific flaws have been reported. It is also unknown whether any of the vulnerabilities are included in CISA’s KEV catalog, and individual CVE identifiers are not available for the full set of fixes.

Atlassian Updates Six Core Products

On Tuesday, Atlassian published a Security Bulletin addressing 10 critical and 162 high-severity vulnerabilities. The updates affect:

• Bamboo;
• Bitbucket;
• Confluence;
• Crowd;
• Fisheye/Crucible;
• Jira.

The total appears to represent approximately 109 unique CVEs, because the same flaw may affect multiple products that share a particular library. Identifiers for the individual issues were not disclosed.

This makes it more difficult to assess enterprise environments. An organization may need to update several platforms at the same time, even when the vulnerability originates not in the product’s main component but in a shared dependency.

The actual impact depends on the affected service, the vulnerable library, and the instance configuration. An Internet-facing installation connected to external systems or equipped with automated integrations has a larger attack surface than an isolated environment.

Splunk Addresses Enterprise, SOAR, and Related Components

On Wednesday, Splunk announced fixes for at least 150 vulnerabilities affecting Splunk Enterprise, Splunk SOAR, Universal Forwarder, applications, add-ons, plugins, and third-party libraries.

For Splunk as well, dozens of issues are classified as critical or high severity. The vendor also highlighted several flaws requiring particular attention, without providing more detailed prioritization criteria in the available materials.

Splunk Enterprise

Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 include fixes for 60 vulnerabilities, three of them critical.

At least 24 flaws, including some critical issues, were fixed in third-party packages used by the product. Verification should therefore not be limited to the Splunk Enterprise version: administrators must also check the status of installed dependencies.

The product can collect and analyze data from numerous infrastructures. A successful compromise could therefore expose operational information, configurations, credentials, or connections to other systems, depending on the privileges assigned to the instance.

Apps, Add-ons, and Splunk SOAR

New versions of Splunk apps and add-ons have been released to address critical vulnerabilities. Affected components include:

• AI Toolkit;
• Connect for Kafka;
• MCP Server app;
• On-Call.

Fixes are also available for Splunk SOAR, including vulnerabilities in its third-party dependencies. The fixed versions for individual apps, add-ons, and SOAR were not disclosed; administrators should therefore consult the official advisories for each component before installation.

Splunk Enterprise Security 8.6.1 also fixes two high-severity vulnerabilities.

SOAR Connectors receive updates addressing 17 medium- and low-severity vulnerabilities. Universal Forwarder, meanwhile, fixes three medium-severity vulnerabilities in OpenSSL.

Why Shared Dependencies Increase Operational Risk

The high number of vulnerabilities does not necessarily mean that every product contains hundreds of distinct flaws. A significant portion stems from software components reused across multiple platforms.

When a shared library is patched, the vendor must distribute updates for every product that incorporates it. Administrators must therefore map their actual deployments, including apps, plugins, connectors, and additional modules.

Risk is higher in systems that are:

• accessible from the Internet;
• integrated with external services;
• authorized to make requests to internal networks;
• used to manage authentication and authorization;
• connected to sensitive data or operational infrastructure.

SSRF vulnerabilities, for example, may allow an attacker to use a compromised server to reach resources that are not directly exposed. Authentication flaws, meanwhile, can weaken or bypass controls that separate users, roles, and administrative functions.

No indicators of compromise, detection rules, or specific workarounds are available. It is also unknown whether any recent Atlassian or Splunk vulnerabilities related to this set are already listed in CISA’s KEV catalog.

What Administrators Should Do

The primary measure is to apply the vendors’ official updates after verifying the environment’s compatibility and dependencies.

For Atlassian, Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira should be upgraded to releases containing the fixes. The corrected version numbers for the individual products were not disclosed.

For Splunk Enterprise, the deployed branch should be upgraded to one of the following versions: 10.4.2, 10.2.6, 10.0.9, or 9.4.14. Enterprise Security should be upgraded to version 8.6.1.

Available updates for AI Toolkit, Connect for Kafka, MCP Server app, On-Call, Splunk SOAR, SOAR Connectors, and Universal Forwarder should also be reviewed and applied. Verification must include OpenSSL and other third-party dependencies.

Priority should be given to Internet-facing systems, instances handling corporate data, and environments capable of reaching internal networks. In the absence of documented workarounds, keeping vulnerable versions in production leaves an attack surface that may affect multiple products simultaneously.