Jenkins CVE-2026-84647

Attacker must have a valid Jenkins account with at minimum Overall/Read permission - the lowest permission level assignable in Jenkins, typically granted to all authenticated users in most organizational deployments. No additional roles, job ownership, or admin rights are required. Jenkins must be accessible over the network (AV:N, typical for any web-accessible CI/CD instance). No special plugin configuration or non-default Jenkins setting is required; the vulnerable code path is in Stapler core and is exercised by standard Jenkins form submissions. Exploitation is limited to authenticated sessions: anonymous (unauthenticated) access is not sufficient unless Overall/Read has been granted to anonymous, which is a non-default but non-rare configuration in internal Jenkins instances.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the attack surface: network-reachable, no complex preconditions, and only Overall/Read permission required. In most Jenkins deployments this is the baseline permission for any authenticated user - including LDAP/SSO accounts, service accounts, and developer logins - making the effective attacker population very large. The high C/I/A impact is consistent with the ability to instantiate arbitrary configuration-related types, which in a plugin-rich Jenkins instance can expose credential stores, job configurations, secret management objects, and execution primitives. No public exploit or active exploitation (CISA KEV) is identified at time of analysis, and EPSS data is not provided in the source, slightly moderating urgency. However, deserialization/unsafe-type-binding gadget chains in Jenkins are historically well-understood by researchers and the low privilege bar means this will attract rapid exploitation tooling development. The S:U (unchanged scope) metric may slightly understate lateral risk given that Jenkins controllers manage build agents and can push code/artifacts to downstream systems.

An authenticated Jenkins user with only Overall/Read permission crafts an HTTP POST request to a Jenkins form endpoint, supplying form field values that reference a configuration-related Java class outside the type hierarchy expected by the binding target. Stapler reflectively instantiates the attacker-specified type, allowing the attacker to trigger side effects from the object's constructor or setters - for example, loading credentials from disk, overwriting configuration files, or invoking internal APIs - resulting in full controller compromise without any elevated privileges.