Jenkins Active Directory Plugin CVE-2026-57288

Exploitation requires that the Jenkins Active Directory Plugin be explicitly configured to use the Windows native (ADSI) authentication path - this is not the default mode and applies only to Windows-hosted Jenkins deployments integrated with Active Directory via ADSI. Jenkins instances using the standard LDAP authentication mode are unaffected regardless of plugin version. For the directory enumeration capability, no further conditions apply beyond network access to the login endpoint. For the authentication bypass, the additional prerequisite is that the attacker already possesses a valid Active Directory password for the target user but lacks the exact username - this materially limits practical impact. High Attack Complexity (AC:H) reflects the precision required in constructing wildcard patterns that resolve to intended targets without ambiguous multi-match failures.

The official CVSS 3.1 score of 3.7 (Low) is grounded in AC:H and C:L, reflecting meaningful real-world constraints: exploitation requires that Jenkins be deployed on Windows with the native ADSI path configured (non-default) and that attackers craft LDAP wildcard expressions with sufficient precision to resolve desired targets. SSVC corroborates this with 'exploitation: none' and 'automatable: no,' indicating no active exploitation and no trivial mass-exploitation path. The confidentiality impact is limited to directory enumeration; the authentication bypass requires the attacker to already possess a valid password, substantially reducing the incremental risk over a straightforward credential-stuffing attack. No EPSS data was provided; absent that signal, the combination of no KEV listing, no POC, and non-automatable SSVC assessment points to a low-urgency but genuine issue for Windows-based Jenkins deployments. There is no CVSS integrity or availability impact, which is consistent with the description - data is not modified and services are not disrupted.

An unauthenticated attacker targeting a Windows-hosted Jenkins instance submits login requests with usernames containing LDAP wildcards (e.g., jsmith* or admin*), causing the ADSI filter to match multiple directory entries and return account existence information, enabling username enumeration. Once a target account is identified, the attacker submits the wildcard pattern as the username alongside the target's known password, authenticating successfully without knowing the exact account name. No public exploit code has been identified at time of analysis.