What is the CVSS score of CVE-2026-70440?

CVE-2026-70440 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Jenkins are affected by CVE-2026-70440?

Multiple remote code execution vulnerabilities in Jenkins core and plugins (CVE-2026-70440) create critical risk to organizations' continuous integration and deployment infrastructure.

How to fix or mitigate CVE-2026-70440?

Within 24 hours: Inventory all Jenkins installations in your environment and identify versions running Jenkins 2.575, LTS 2.568.1, or earlier; document any exposed Jenkins controllers accessible from untrusted networks. Within 7 days: Implement network segmentation to restrict Jenkins controller access to only authorized build agents and administrators; disable Jenkins file parameter features if your workflows permit; disable vulnerable plugins where functionality allows; and enable comprehensive logging and alerting on Jenkins controller access and job execution. Within 30 days: Establish daily monitoring of Jenkins security advisories and vendor updates; prepare and test a remediation plan for rapid deployment when vendor patches become available; consider isolating critical build pipelines to air-gapped or containerized Jenkins instances with reduced external connectivity.

Jenkins CVE-2026-70440

EUVD-2026-53534 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-05

GHSA-rmwj-785q-j3gv

XSS Jenkins

5.4

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

9.9 CRITICAL

Based on CVE-2026-70426 as the most severe component: network-accessible Remoting channel, low-privilege Agent/Connect access, scope change from agent to controller, full RCE impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:21 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Multiple high-severity vulnerabilities in Jenkins core and a range of plugins disclosed in the August 2026 security advisory allow attackers to achieve remote code execution on the Jenkins controller, perform arbitrary file writes, bypass deserialization protections, impersonate users, and enumerate stored credentials. Affected versions include Jenkins 2.575 and LTS 2.568.1 and earlier, with the most critical issues residing in the Remoting deserialization layer (CVE-2026-70426), tar archive handling (CVE-2026-70427), and file parameter path traversal (CVE-2026-70428), all of which ultimately enable code execution on the controller JVM. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack surface breadth and severity of RCE-capable issues make this advisory a high-priority patching event for any Jenkins deployment.

Technical ContextAI

Jenkins relies on its Remoting library (agent.jar/remoting.jar) for serialized Java object communication between the controller and build agents, with JEP-200 providing a class allowlist filter to prevent deserialization gadget attacks. CVE-2026-70426 exposes a fallback deserialization code path in Remoting 3384.v60d89463d9e0 and earlier that bypasses this filter for classes on the Jenkins core classpath not on the pre-JEP-200 denylist. CVE-2026-70427 exploits improper handling of symbolic links with empty-like names in tar and tar.gz extraction, enabling path escape to arbitrary controller filesystem locations. CVE-2026-70428 exploits a flawed path traversal check in file parameter name parsing. CVE-2026-70429 abuses a Unicode normalization inconsistency - canonical ID lowercasing versus String#equalsIgnoreCase comparison - allowing 'dotless i' (U+0131) and similar characters to collide with ASCII equivalents, enabling account impersonation. CVE-2026-70430 allows unrestricted instantiation of arbitrary Java types via the project naming strategy configuration. CVE-2026-70431/70432 affect Multijob Plugin's Groovy scripting, which is not gated through the Script Security Plugin, enabling unsandboxed JVM-level code execution. No CWE or CPE was provided in the input data; affected CPEs are inferred as cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* up to 2.568.1 and cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* up to 2.575.

RemediationAI

Upgrade Jenkins core to version 2.576 (weekly) or LTS 2.568.2 immediately to address CVE-2026-70426 through CVE-2026-70430. For plugins, upgrade to: External Workspace Manager Plugin 1.4.2, HCL AppScan Plugin 1.8.4, Multijob Plugin 677.v7ffc23d6a_4c2, SCM-Manager Plugin 1.12.1, and Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8. For the eleven plugins with unresolved vulnerabilities (including AWS CodeBuild, CodeSonar, Google Chat Notification, and others), consider disabling or removing them until fixes are released, as the Jenkins project explicitly flags them as having unresolved security issues. As a compensating control for agent-to-controller RCE vectors (CVE-2026-70426, CVE-2026-70427), restrict Agent/Connect permissions to trusted infrastructure only and isolate agent nodes from sensitive controller filesystem directories; note this reduces but does not eliminate risk. For CVE-2026-70428, restrict Item/Configure and Item/Build permissions to vetted users. Advisory URL: https://www.jenkins.io/security/advisory/2026-08-05/.