What is the CVSS score of CVE-2026-70443?

CVE-2026-70443 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Jenkins are affected by CVE-2026-70443?

Jenkins, a critical CI/CD infrastructure component used by most organizations for software delivery, is affected by a critical unpatched vulnerability disclosed on August 5, 2026.

How to fix or mitigate CVE-2026-70443?

Within 24 hours: Inventory all Jenkins deployments across your organization, document their versions, and cross-reference against the August 5, 2026 Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-08-05/ to confirm whether your instances are affected. Within 7 days: Implement compensating controls including network access restrictions to Jenkins administrative interfaces, disable non-critical plugins, implement enhanced logging and monitoring of build pipeline activities, and ensure critical credentials are stored in isolated secret management systems separate from Jenkins. Within 30 days: Continue monitoring Jenkins security advisories for patch availability; establish an expedited deployment process to apply the critical patch immediately upon vendor release, testing it in a non-production environment first.

Jenkins CVE-2026-70443

EUVD-2026-53537 MEDIUM

Improper Privilege Management (CWE-269)

2026-08-05

GHSA-84xf-jvr9-x4f9

Jenkins Privilege Escalation

4.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 16:26 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

CVE-2026-70443 is part of the Jenkins August 5, 2026 batch security advisory covering Jenkins core and multiple plugins. The provided source data does not include the specific vulnerability description for CVE-2026-70443 - the advisory text is truncated before reaching this CVE identifier (described CVEs end around CVE-2026-70435). The full advisory at https://www.jenkins.io/security/advisory/2026-08-05/ contains authoritative details. No active exploitation is confirmed (not listed in CISA KEV), and no EPSS or CVSS data was provided in the source intelligence.

Technical ContextAI

Jenkins is a widely deployed open-source automation server used for CI/CD pipelines. This advisory batch addresses issues spanning the Jenkins Remoting library (Java object deserialization), archive extraction handling, path traversal in file parameters, Unicode case-folding in user/group identity, object instantiation in project naming strategies, Groovy scripting in plugin contexts, CSRF protections, and credential enumeration in plugin HTTP endpoints. CVE-2026-70443 falls within this same advisory scope but its specific CWE, affected component, and root cause are not derivable from the provided truncated data. The advisory numbering gap (CVE-2026-70435 to CVE-2026-70443) suggests this CVE may relate to one of the plugins receiving fixes - External Workspace Manager Plugin 1.4.2, SCM-Manager Plugin 1.12.1, or Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8 - or one of the plugins listed as having unresolved issues.

RemediationAI

Upgrade Jenkins core to version 2.576 (weekly) or Jenkins LTS 2.568.2 to address core vulnerabilities in this advisory batch. Upgrade affected plugins to their patched versions: External Workspace Manager Plugin to 1.4.2, HCL AppScan Plugin to 1.8.4, Multijob Plugin to 677.v7ffc23d6a_4c2, SCM-Manager Plugin to 1.12.1, and Webhook Secret Credentials Provider Plugin to 32.v09c9b_522f0a_8. Because the specific fix mapping for CVE-2026-70443 is not confirmed from available data, administrators should review the full advisory at https://www.jenkins.io/security/advisory/2026-08-05/ to identify the precise component and upgrade target. Note that several plugins listed in the advisory (AWS CodeBuild, CodeSonar, Google Chat Notification, and others) have unresolved issues with no fix available - apply principle of least privilege and restrict access to those plugin features as a compensating control until patches are released.