What is the CVSS score of CVE-2026-48919?

CVE-2026-48919 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-48919?

Yes, a patch is available for CVE-2026-48919. Update the affected software to the latest version immediately.

Active Directory Plugin CVE-2026-48919

EUVD-2026-32510 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-p2gw-f3rv-82mw

Deserialization Jenkins

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:14 vuln.today

CVE Published

May 27, 2026 - 15:16 nvd

MEDIUM 6.6

DescriptionCVE.org

Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.

AnalysisAI

Unsafe deserialization in Jenkins Active Directory Plugin 2.41 and earlier allows a remote attacker holding administrative credentials to achieve full system compromise by manipulating the LDAP referral processing path. The plugin deserializes data received from LDAP referrals without validation (CWE-502), which can enable arbitrary code execution on the Jenkins controller. No public exploit exists at time of analysis, and CISA SSVC assesses this as not automatable, though technical impact is rated total - making it a targeted rather than opportunistic threat.

Technical ContextAI

Jenkins Active Directory Plugin integrates Jenkins with Microsoft Active Directory authentication via LDAP. LDAP referrals are standard protocol responses where one directory server redirects a client to query another - a feature this plugin follows automatically during authentication lookups. The root cause is CWE-502 (Deserialization of Untrusted Data): when the plugin receives and processes data from a referred LDAP server, it deserializes the content without any integrity or class validation. This is a well-understood Java attack primitive - a crafted serialized object payload embedded in the referral response can trigger gadget chains leading to arbitrary code execution. The affected CPE scope covers Jenkins Active Directory Plugin from version 0 through 2.41 inclusive, as confirmed by EUVD-2026-32510.

RemediationAI

The primary remediation is to upgrade Jenkins Active Directory Plugin to a version beyond 2.41 as directed by the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3659. The exact patched release version number is not independently confirmed from the provided input data and must be obtained directly from that advisory. As a compensating control where immediate patching is not feasible, administrators can disable LDAP referral following in the Active Directory plugin configuration, preventing the plugin from processing data from referred LDAP servers entirely; note this may break cross-domain or multi-forest Active Directory authentication. Strictly enforcing the principle of least privilege for Jenkins administrative accounts reduces the attack surface, since PR:H is a hard prerequisite for exploitation. Network-level egress filtering restricting outbound LDAP connections from the Jenkins host to only known, trusted domain controllers limits exposure to attacker-controlled referral endpoints.