Atlassian, Splunk patch 250+ critical and high vulnerabilities

Atlassian and Splunk released security updates this week that address more than 250 vulnerabilities across multiple products. Atlassian’s bulletin, published Tuesday, lists fixes for 10 critical and 162 high-severity issues tied to third-party libraries used in Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible and Jira. The fixes cover roughly 109 unique CVEs.

The bulletin warns that successful exploitation of some defects could allow remote code execution, denial-of-service, information theft, man-in-the-middle attacks, authentication bypass and server-side request forgery.

On Wednesday Splunk published updates for Splunk Enterprise, SOAR, Universal Forwarder and related apps and add-ons. Enterprise versions 10.4.2, 10.2.6, 10.0.9 and 9.4.14 address 60 vulnerabilities, including three rated critical. Splunk also patched at least two dozen security defects in third-party packages bundled with Enterprise.

Several Splunk Apps and Add-ons, including AI Toolkit, Connect for Kafka, MCP Server app and On-Call, received updates for critical and high-severity bugs. Multiple dependency issues in SOAR were corrected. Splunk released Enterprise Security 8.6.1 to fix two high-severity issues, updated SOAR Connectors to resolve 17 medium- and low-severity flaws, and issued a Universal Forwarder update that addresses three medium-severity OpenSSL weaknesses.

Both vendors report that many defects stem from shared libraries embedded across products, so a single vulnerable dependency can affect multiple applications. That pattern accounts for many CVEs being addressed at once.

Atlassian’s bulletin lists affected product versions and the patched library versions. Splunk’s release notes and product pages list version numbers and mitigation details for each update. Administrators are advised to consult the vendor notices to determine which releases to install.

Industry tracking shows an increase in large, multi-product patch releases in recent months as vendors update embedded third-party components.