Jenkins Core CVE-2026-117618

The exploitation prerequisites for CVE-2026-117618 are not stated in the provided sources - the advisory excerpt describes CVE-2026-117612 through -117617, -117621, and -117622 but does not include a description for the -117618 identifier. For the described sibling vulnerabilities in the same advisory, prerequisites range from Overall/Read permission plus a non-anonymous account, to Item/Configure, Agent/Configure, or Item/Create permission, meaning an authenticated foothold with configuration privileges is the limiting factor; whether any of these apply to -117618 specifically is unverified. The Jenkins advisory page (https://www.jenkins.io/security/advisory/2026-10-28/) must be consulted for this CVE's exact condition.

This entry is part of the Jenkins Security Advisory 2026-10-28, a bundle announcing multiple Jenkins core vulnerabilities (SECURITY-4125/CVE-2026-117612 through SECURITY-4249/CVE-2026-117622). The specific vulnerability CVE-2026-117618 is NOT individually described in the provided data - the advisory excerpt is truncated after SECURITY-4249/CVE-2026-117622, and no SECURITY- ticket or description maps to the -117618 identifier here, so its mechanism, severity, and permission prerequisites cannot be assessed from the supplied sources. On the signal side, the input provides no CVSS base vector (advisory and linked article 2 both report CVSS Score/Vector as N/A), no EPSS probability, no CISA KEV listing, and no POC/exploit reference; the vuln.today Decision label is 'awaiting_data', which is consistent with this incomplete picture rather than indicating low risk. For context, the siblings in the same advisory that ARE described are rated High by the Jenkins CNA and include deserialization RCE, agent-launch command injection, symlink-based arbitrary file read/write leading to RCE, and stored XSS - all gated behind some level of authenticated Jenkins permission (Overall/Read, Item/Configure, Agent/Configure, or Item/Create). Because -117618's own data is missing, any numeric-score comparison is impossible: there is no CVSS-vs-EPSS or KEV-vs-EPSS tension to resolve, only a genuine data gap. Treat this as 'awaiting data' - the correct action is to pull the per-CVE detail from the Jenkins advisory page before prioritizing, not to assume it is either critical or benign.

The specific trigger for CVE-2026-117618 is not described in the available sources, so a precise scenario cannot be constructed without over-inferring. In the broader 2026-10-28 Jenkins core advisory, the described sibling flaws involve an attacker holding a modest authenticated permission (e.g., Item/Configure or Agent/Configure) submitting a crafted config.xml or agent configuration to the controller, which can escalate to code execution in the controller JVM. No public exploit identified at time of analysis for CVE-2026-117618.