EUVD-2026-53539
GHSA-m8x8-7jhh-fp73
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConsult vendor advisory
-
DeliveryIdentify affected component
-
ExploitAssess required access level
-
ExecutionExecute vulnerability-specific exploit
-
ImpactAchieve disclosed impact
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The specific exploitation conditions for CVE-2026-70445 are not determinable from the provided input data - the vulnerability description was not included in the truncated oss-security disclosure. No CVSS vector was supplied, so authentication requirements, attack vector, and complexity cannot be assessed. Administrators should consult https://www.jenkins.io/security/advisory/2026-08-05/ for the specific conditions required to exploit this CVE, including whether it requires any Jenkins permission level, a specific plugin or configuration, or network access. |
| Impact | No CVSS vector, EPSS score, KEV status, or POC availability was provided for CVE-2026-70445. Without these signals, a reliable risk tier cannot be assigned. The broader advisory context is significant: several co-disclosed CVEs (notably CVE-2026-70426 through CVE-2026-70428) enable remote code execution on the Jenkins controller via agent-level access, making this advisory batch high-priority overall. However, that severity cannot be attributed to CVE-2026-70445 specifically without its own data. Whether this CVE is a core Jenkins issue or a plugin-specific issue meaningfully changes the attack surface - Jenkins core vulnerabilities affect all installations, while plugin vulnerabilities affect only those with that plugin installed and enabled. Risk assessment for this specific CVE must be deferred to the vendor advisory. |
| Exploit ScenarioDerived | Without the specific vulnerability description for CVE-2026-70445, a grounded exploit scenario cannot be constructed. The broader advisory context shows that several co-disclosed vulnerabilities allow code execution on the Jenkins controller via agent manipulation or crafted input by users with low-privilege Jenkins permissions, but attributing this scenario to CVE-2026-70445 specifically would be speculation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
CVE-2026-70445 is one of multiple security vulnerabilities disclosed in the Jenkins security advisory published 2026-08-05, affecting Jenkins core and a range of Jenkins plugins. The specific vulnerability details for this CVE ID were not included in the provided input data - the oss-security disclosure text was truncated before reaching the description of CVE-2026-70445, which falls beyond CVE-2026-70435 in the sequential numbering. Based on the advisory structure, this CVE likely pertains to one of the Jenkins plugins listed either as patched (External Workspace Manager, HCL AppScan, Multijob, SCM-Manager, Webhook Secret Credentials Provider) or as containing unresolved issues (AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, XML Job to Job DSL). No public exploit, KEV listing, or EPSS score was provided.
RemediationAI
Upgrade Jenkins core to 2.576 (weekly) or LTS 2.568.2 to address all core vulnerabilities in this advisory. For plugins with available fixes, upgrade to: External Workspace Manager Plugin 1.4.2, HCL AppScan Plugin 1.8.4, Multijob Plugin 677.v7ffc23d6a_4c2, SCM-Manager Plugin 1.12.1, and Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8. Since the specific component addressed by CVE-2026-70445 is unknown from the provided data, administrators should consult https://www.jenkins.io/security/advisory/2026-08-05/ to identify the exact plugin and version required. For plugins listed as having unresolved security issues (AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, XML Job to Job DSL), no patch was available at advisory publication time - consider disabling these plugins if their functionality is not essential until fixes are released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jenkins is a widely deployed open-source automation server used for CI/CD pipelines. The 2026-08-05 advisory encompasses vulnerabilities in Jenkins core (versions up to 2.575 / LTS 2.568.1) and multiple community plugins. The advisory covers a broad range of CWE classes based on the disclosed CVEs: deserialization filter bypass (CWE-502), path traversal and arbitrary file write (CWE-22), CSRF (CWE-352), missing permission checks (CWE-862), and improper string comparison (CWE-178). CVE-2026-70445 specifically falls outside the portion of the advisory text provided; its CWE, affected component, and root cause class are not determinable from the supplied data. The authoritative technical details are at https://www.jenkins.io/security/advisory/2026-08-05/.
Know when Jenkins gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (CNA) · only source for this CVE.
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Executive ViewAI
A critical-severity vulnerability in Jenkins core or plugins disclosed 2026-08-05 has no vendor patch available, creating immediate risk to organizations dependent on Jenkins for CI/CD operations. Unpatched instances remain vulnerable with no remediation path currently available from the vendor.
No vendor-released patch identified at time of analysis. Interim mitigations must be extracted from the complete 2026-08-05 Jenkins security advisory. Network isolation, access restrictions, and plugin disablement (if feasible) are the primary interim controls available pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Exploit-DB