What is the CVSS score of CVE-2026-27099?

CVE-2026-27099 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jenkins are affected by CVE-2026-27099?

Jenkins deployments (versions 2.483-2.550 and LTS 2.492.1-2.541.1) contain a stored cross-site scripting vulnerability that allows authenticated users with agent configuration permissions to inject…. A patch is available.

How to fix or mitigate CVE-2026-27099?

Within 24 hours: Identify all Jenkins instances running affected versions and document affected user populations with Agent/Configure or Agent/Disconnect permissions. Within 7 days: Implement network segmentation restricting Jenkins agent management access, disable the 'Mark temporarily offline' feature if operationally feasible, and monitor access logs for suspicious agent configuration changes. Within 30 days: Establish a vendor patch monitoring process and prepare for immediate deployment once Jenkins releases a security update; consider upgrading to unaffected versions if available.

Jenkins CVE-2026-27099

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-18 jenkinsci-cert@googlegroups.com

GHSA-85h6-5m3v-gx37

Jenkins XSS Red Hat

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Red Hat

4.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 18, 2026 - 15:18 nvd

HIGH 8.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.jenkins-ci.main:jenkins-core (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.542.

DescriptionCVE.org

Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.

AnalysisAI

Jenkins versions 2.483-2.550 and LTS 2.492.1-2.541.1 contain a stored XSS vulnerability in the agent offline cause description field that fails to properly sanitize user input. Attackers with Agent/Configure or Agent/Disconnect permissions can inject malicious scripts that execute in the browsers of other users viewing the affected agent configuration. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Jenkins. Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.