What is the CVSS score of CVE-2026-57280?

CVE-2026-57280 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Jenkins Script Security Plugin are affected by CVE-2026-57280?

Jenkins Script Security Plugin versions 1402.v94c9ce464861 and earlier contain a sandbox bypass vulnerability (CVSS 8.8) that enables arbitrary code execution on the Jenkins controller through…

How to fix or mitigate CVE-2026-57280?

Within 24 hours, inventory all Jenkins instances running Script Security Plugin version 1402.v94c9ce464861 or earlier and determine which are exposed to script submission. Within 7 days, implement interim controls: restrict Groovy script submission permissions to a minimal set of trusted administrators only, isolate the Jenkins controller at the network level, and disable the Script Security Plugin entirely if it is not operationally required. Within 30 days, continuously monitor the Jenkins SECURITY-3792 advisory for patch availability; deploy the fix immediately upon release, maintain compensating controls until remediation is complete, and conduct a security review of all scripts submitted during the vulnerability window.

Jenkins Script Security Plugin CVE-2026-57280

EUVD-2026-38760 HIGH

Protection Mechanism Failure (CWE-693)

2026-06-24 jenkins

GHSA-c3jm-9vj7-5v66

Authentication Bypass Jenkins Red Hat Jenkins Script Security Plugin Jenkins Project

8.8

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:02 vuln.today

CVE Published

Jun 24, 2026 - 13:20 cve.org

HIGH 8.8

CVE Published

Jun 24, 2026 - 13:20 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.

Articles & Coverage 2

News 5 New Jenkins Vulnerabilities - 5 High Severity, No Public Exploits Jun 25, 2026 News 5 New Jenkins Vulnerabilities - 5 High Severity, No Public Exploits Jun 24, 2026

AnalysisAI

Sandbox bypass in the Jenkins Script Security Plugin (1402.v94c9ce464861 and earlier) lets users who can supply sandboxed Groovy scripts invoke arbitrary constructors, escaping the sandbox to run unrestricted code on the Jenkins controller. The flaw stems from the plugin failing to intercept implicit type casts on elements of typed for-each loops, a subtle gap in its interception logic. Reported by the Jenkins project (SECURITY-3792) with no public exploit identified at time of analysis; EPSS is low at 0.37% and CISA SSVC records no observed exploitation.