EUVD-2026-112190
GHSA-x7gp-5c7m-pffw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Jenkins with low-privilege permission
-
ExploitSubmit crafted configuration or serialized payload
-
ExecutionTrigger flaw in Jenkins core processing
-
ImpactAchieve impact on controller (RCE/XSS/file access per final vendor scoring)
Vulnerability Assessment
| Exploitation Conditions | The exact prerequisites for CVE-2026-117625 are not described in the available sources; the supplied advisory text does not include this CVE's entry, so its required feature, permission, or configuration cannot be stated. What is confirmed for the advisory as a whole: affected systems are Jenkins core 2.587 and earlier / LTS 2.580.1 and earlier, and the related vulnerabilities require an authenticated user with a Jenkins permission (e.g., Overall/Read, Item/Configure, View/Configure, or Agent/Configure) rather than anonymous network access. A general limiting factor across this advisory is that exploitation is gated behind authenticated, non-anonymous access to the Jenkins instance; some XSS issues in the batch are additionally mitigated by Content Security Policy on Jenkins 2.539+/LTS 2.541.1+. The only confirmed complete remediation is upgrading to Jenkins 2.588 or LTS 2.580.2. |
| Impact | Key decision signals are largely absent or unresolved for this specific CVE. The input provides no CVSS vector (advisory pages return CVSS N/A), no EPSS score, no CISA KEV listing, and no PoC or exploit reference; the vuln.today Decision label is 'awaiting_data', so this is not flagged act_now or emergency. Critically, CVE-2026-117625 is itself a data gap: the supplied oss-security description is the umbrella 'Multiple vulnerabilities in Jenkins' advisory text, which is truncated after SECURITY-4249 / CVE-2026-117622 and contains NO dedicated entry for CVE-2026-117625 - its specific mechanism, affected component, required permissions, and severity are not present in the available sources. The surrounding advisory (2026-10-28) establishes a consistent pattern of high-severity Jenkins core flaws exploitable by authenticated, low-privilege users (Overall/Read, Item/Configure, Agent/Configure) leading to stored XSS, arbitrary file read, or remote code execution in the controller JVM, all fixed in Jenkins 2.588 and LTS 2.580.2. Treat this as a likely authenticated-access Jenkins core issue of moderate-to-high severity pending the vendor's per-CVE scoring, but do NOT assume network-unauthenticated exploitation: no signal confirms that, and the companion CVEs all require some authenticated permission. Verify the exact impact against the vendor advisory section for SECURITY identifier mapped to CVE-2026-117625 before prioritizing. |
| Exploit ScenarioDerived | The specific attack mechanism for CVE-2026-117625 is not described in the available sources, so a concrete scenario cannot be reconstructed with confidence. Based on the pattern of the companion vulnerabilities in the same advisory, a plausible (unconfirmed) scenario is an authenticated user holding a low-privilege Jenkins permission such as Item/Configure or Agent/Configure submitting crafted configuration/serialized data to a Jenkins controller running 2.587/LTS 2.580.1 or earlier. No PoC or exploit code is referenced in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Jenkins core 2.587 and earlier, along with LTS 2.580.1 and earlier, are covered by the 2026-10-28 Jenkins security advisory, and the EUVD record for this CVE points to advisory section SECURITY-4206; that section's text is not included in the material supplied here, so the specific defect, its trigger, and its exact permission prerequisites for CVE-2026-117625 cannot be confirmed from available data. What is confirmed for the advisory as a whole is that every listed issue requires an authenticated, non-anonymous Jenkins user holding a permission such as Overall/Read, Item/Configure, View/Configure, or Agent/Configure, and that several of the batch lead to remote code execution or stored cross-site scripting on the controller. No public exploit code or confirmed active exploitation is identified in the supplied sources, and the priority decision remains awaiting data, so treatment should be driven by the confirmed availability of the 2.588 / LTS 2.580.2 fix rather than by an exploitation signal.
RemediationAI
Upgrade Jenkins core to 2.588 or to LTS 2.580.2, the only confirmed complete remediation in the supplied material, following the guidance at https://www.jenkins.io/security/advisory/2026-10-28/. Administrators who encounter problems with the newly added XStream type permissions system in 2.588 / LTS 2.580.2 can disable that added layer by setting the Java system property hudson.util.XStream2.SUPPRESS_TYPE_PERMISSION to true, with the explicit trade-off that deserialization type enforcement is weakened again, so this should be treated as a temporary measure while the incompatibility is resolved. For the XSS-class issues in the same batch, the advisory notes that enforcing Content Security Policy on Jenkins 2.539+/LTS 2.541.1+ mitigates the known impact; that tip is stated for the specific XSS entries and is not documented for SECURITY-4206, so it should not be relied on as the primary control for this CVE. Because every issue in the advisory requires an authenticated, non-anonymous account with a Jenkins permission, restricting who holds Overall/Read, Item/Configure, View/Configure and Agent/Configure reduces exposure during the upgrade window, but the advisory presents upgrading as the complete fix rather than these permission reductions.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jenkins persists configuration and build data through XStream, and since JEP-200 it wraps deserialization in a custom filter that only permits types defined in Jenkins core or plugins, or types explicitly allowlisted - a control motivated by gadget chains that abuse #readResolve behavior during deserialization. The published advisory describes a cluster of related breakdowns in that model across the same release window: a custom converter that failed to apply the deserialization filter to classes named in the resolves-to attribute (SECURITY-4125), collection element types that were not constrained after deserialization, allowing crafted job config.xml documents to yield stored XSS (SECURITY-4225), backward-compatible conversion of legacy agent launch commands into Command Agent Launcher Plugin launchers without checking administrator approval (SECURITY-4123), symbolic-link handling flaws during item rename copies (SECURITY-4187) and concurrent artifact extraction (SECURITY-4248), an HTTP endpoint that loads any config.xml by name as an agent definition (SECURITY-4188), and agent-computed workspace browser link URLs enabling XSS by an attacker controlling an agent process (SECURITY-4232). CVE-2026-117625 itself corresponds to SECURITY-4206, whose description is truncated in the supplied sources and for which no CWE, CVSS vector, or mechanism detail was provided; the root-cause class for this specific identifier should therefore be treated as unverified rather than assumed to match any of the sibling entries.
Know when Jenkins gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Description PRE-NVD
Executive ViewAI
Jenkins core, a widely used automation server, has a critical vulnerability (CVE-2026-117625) affecting versions up to 2.587 and LTS 2.580.1. Successful exploitation could allow authenticated users with basic permissions to execute remote code or inject stored scripts, potentially compromising the entire CI/CD pipeline and sensitive build data. Leadership should prioritize immediate patching to prevent unauthorized access and maintain software delivery integrity.
Apply vendor patch.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Exploit-DB