Jenkins CVE-2026-117619

Exploitation prerequisites for CVE-2026-117619 are not stated in the available sources - its per-CVE description is absent from the supplied advisory excerpt, so the exact required Jenkins feature, permission, or configuration cannot be named. What is confirmed from the surrounding advisory is that the affected scope is Jenkins core 2.587 and earlier / LTS 2.580.1 and earlier, and that the fix is Jenkins 2.588 / LTS 2.580.2. The other issues in this same advisory uniformly require an authenticated, permissioned user (e.g., Overall/Read, Item/Configure, View/Configure, Agent/Configure, or Item/Create) rather than anonymous access, which suggests a privilege prerequisite is likely here too - but this is not verified for -117619. Verify the exact preconditions against the per-CVE entry at https://www.jenkins.io/security/advisory/2026-10-28/.

Risk cannot be assessed with confidence for CVE-2026-117619 specifically, because the supplied data does not contain a description for this CVE. The oss-security post and the Jenkins advisory 2026-10-28 are a BUNDLE covering many Jenkins core issues (CVE-2026-117612, -117613, -117614, -117615, -117616, -117617, -117621, -117622 are summarized), but CVE-2026-117619 is NOT among the summaries provided - its entry is absent from the excerpt. No CVSS vector is supplied (the linked article reports CVSS/CVE/CWE as N/A at the summary level), EPSS is not provided, there is no CISA KEV listing, and no PoC or exploit reference appears. The vuln.today Decision label is 'awaiting_data', which is consistent with this gap and means this is NOT currently flagged as an act_now/emergency item. Across the Jenkins core issues that ARE described in this advisory, the common pattern is an authenticated attacker holding specific Jenkins permissions (Overall/Read, Item/Configure, Agent/Configure, or Item/Create) abusing configuration/deserialization/file-handling paths on the controller, several of which can escalate to RCE; however, applying that pattern to -117619 would be speculation. Net: this is a vendor-confirmed Jenkins core advisory (fixes shipped), but for THIS specific CVE the real-world priority is undetermined pending the per-CVE description, severity, and CVSS vector from the Jenkins advisory.

No realistic scenario can be constructed for CVE-2026-117619 because its specific description, affected component, and mechanism are missing from the supplied data (it is one of several CVEs in the 2026-10-28 Jenkins bundle that were not detailed in the provided excerpt). The broader advisory's described issues generally require an attacker to already hold a Jenkins user account with a */Configure or Overall/Read permission before abusing controller-side handling, but whether -117619 follows that model is unconfirmed. No PoC or exploit reference is present in the input.