What is the CVSS score of CVE-2026-70443?

CVE-2026-70443 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-70443?

Within 24 hours: Inventory all Jenkins deployments across your organization, document their versions, and cross-reference against the August 5, 2026 Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-08-05/ to confirm whether your instances are affected. Within 7 days: Implement compensating controls including network access restrictions to Jenkins administrative interfaces, disable non-critical plugins, implement enhanced logging and monitoring of build pipeline activities, and ensure critical credentials are stored in isolated secret management systems separate from Jenkins. Within 30 days: Continue monitoring Jenkins security advisories for patch availability; establish an expedited deployment process to apply the critical patch immediately upon vendor release, testing it in a non-production environment first.

Jenkins CVE-2026-70443

EUVD-2026-53537 MEDIUM

Improper Privilege Management (CWE-269)

2026-08-05

GHSA-84xf-jvr9-x4f9

Privilege Escalation Jenkins

4.3

CVSS 3.1 · Vendor

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Access Jenkins instance
Exploit

Identify vulnerable component
Execution

Exploit CVE-2026-70443
Impact

Achieve impact

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation conditions for CVE-2026-70443 are unknown - the specific vulnerability description was not present in the provided source data. The broader advisory contains CVEs requiring varying conditions: some require Agent/Connect permission (deserialization bypass), some require Item/Configure and Item/Build (path traversal), some require Overall/Manage (object instantiation), and some require only Overall/Read (credential enumeration). Until the specific entry for CVE-2026-70443 is reviewed in the full advisory, authentication requirements, required permissions, and configuration prerequisites cannot be stated. Review https://www.jenkins.io/security/advisory/2026-08-05/ to determine the exact conditions.
Impact	No CVSS vector, EPSS score, or KEV status is available for CVE-2026-70443. The advisory batch as a whole includes high-severity findings (remote code execution via deserialization bypass, arbitrary file write via archive extraction, and path traversal leading to code execution), but the specific severity of CVE-2026-70443 cannot be assessed without its description. MISSING: CVSS vector, CWE, affected product/version within the advisory, and POC status are all unknown for this specific CVE. Risk cannot be reliably rated until the full advisory entry is reviewed at the canonical advisory URL. Other CVEs in this batch range from credential enumeration (low-medium) to RCE on the Jenkins controller (critical); this CVE's position in the same advisory does not imply equivalent severity.
Exploit ScenarioDerived	Without the specific vulnerability description for CVE-2026-70443, a realistic attack scenario cannot be constructed. The broader advisory batch includes scenarios where attackers with low or no-privilege Jenkins access (Agent/Connect, Item/Configure, or Overall/Read permissions) can escalate to arbitrary code execution on the Jenkins controller - a pattern that may or may not apply to this specific CVE. No public exploit code has been identified for CVE-2026-70443 at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 05, 2026

CVE-2026-70443 is part of the Jenkins August 5, 2026 batch security advisory covering Jenkins core and multiple plugins. The provided source data does not include the specific vulnerability description for CVE-2026-70443 - the advisory text is truncated before reaching this CVE identifier (described CVEs end around CVE-2026-70435). The full advisory at https://www.jenkins.io/security/advisory/2026-08-05/ contains authoritative details. No active exploitation is confirmed (not listed in CISA KEV), and no EPSS or CVSS data was provided in the source intelligence.

RemediationAI

Upgrade Jenkins core to version 2.576 (weekly) or Jenkins LTS 2.568.2 to address core vulnerabilities in this advisory batch. Upgrade affected plugins to their patched versions: External Workspace Manager Plugin to 1.4.2, HCL AppScan Plugin to 1.8.4, Multijob Plugin to 677.v7ffc23d6a_4c2, SCM-Manager Plugin to 1.12.1, and Webhook Secret Credentials Provider Plugin to 32.v09c9b_522f0a_8. Because the specific fix mapping for CVE-2026-70443 is not confirmed from available data, administrators should review the full advisory at https://www.jenkins.io/security/advisory/2026-08-05/ to identify the precise component and upgrade target. Note that several plugins listed in the advisory (AWS CodeBuild, CodeSonar, Google Chat Notification, and others) have unresolved issues with no fix available - apply principle of least privilege and restrict access to those plugin features as a compensating control until patches are released.

Affected VersionsENISA

Jenkins Horreum Plugin 0 ≤0.16.162.v33b_4a_a_b_5f828

Affected Packages

euvd jenkins_horreum_plugin no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Jenkins is a widely deployed open-source automation server used for CI/CD pipelines. This advisory batch addresses issues spanning the Jenkins Remoting library (Java object deserialization), archive extraction handling, path traversal in file parameters, Unicode case-folding in user/group identity, object instantiation in project naming strategies, Groovy scripting in plugin contexts, CSRF protections, and credential enumeration in plugin HTTP endpoints. CVE-2026-70443 falls within this same advisory scope but its specific CWE, affected component, and root cause are not derivable from the provided truncated data. The advisory numbering gap (CVE-2026-70435 to CVE-2026-70443) suggests this CVE may relate to one of the plugins receiving fixes - External Workspace Manager Plugin 1.4.2, SCM-Manager Plugin 1.12.1, or Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8 - or one of the plugins listed as having unresolved issues.

Know when Jenkins gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

Jenkins, a critical CI/CD infrastructure component used by most organizations for software delivery, is affected by a critical unpatched vulnerability disclosed on August 5, 2026. With no vendor patch currently available, every build executed through affected instances faces potential compromise, directly threatening the integrity and security of software releases and enterprise deployment pipelines.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to Jenkins administrative console and API interfaces to authorized personnel and networks only; isolate Jenkins credentials in dedicated external secret management systems; disable unnecessary plugins that could expand attack surface; implement comprehensive audit logging for all build activities; maintain enhanced monitoring for suspicious access patterns; and establish an expedited patch deployment plan to apply the fix immediately upon vendor release.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

High

Jenkins is widely deployed CI/CD platform across enterprise environments globally.

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Very High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +22

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.