Multiple vulnerabilities in Jenkins and Jenkins plugins (CVE-2026-70440)

The Jenkins project disclosed multiple security vulnerabilities affecting Jenkins core and several plugins, including deserialization filter bypass, path traversal, arbitrary file write, CSRF, missing permission checks, and code execution issues. Exploitation of these vulnerabilities could allow attackers to execute arbitrary code on the Jenkins controller, write files to arbitrary locations, impersonate users, or enumerate credentials, depending on the specific vulnerability. CVE-2026-70440 is not individually described in the provided advisory text; no further detail beyond the umbrella disclosure is available here. Affected versions: - Jenkins 2.575 and earlier - Jenkins LTS 2.568.1 and earlier - Multijob Plugin 669.v9d96a_d9c71b_0 and earlier - HCL AppScan Plugin 1.8.3 and earlier - Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987 We recommend updating to: Jenkins 2.576, Jenkins LTS 2.568.2, External Workspace Manager Plugin 1.4.2, HCL AppScan Plugin 1.8.4, Multijob Plugin 677.v7ffc23d6a_4c2, SCM-Manager Plugin 1.12.1, Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/438 Details: https://vuln.today/cve/CVE-2026-70440