Jenkins CVE-2026-84652

Exploitation requires two concurrent conditions: (1) the attacker must have the capability to serve arbitrary content on the same site/origin as the Jenkins instance - achievable via a low-privilege Jenkins account with job creation or workspace file-serving access, or any other same-origin content delivery mechanism - to plant a predictable session identifier in the victim's browser; and (2) the victim must be using the 'remember me' persistent authentication cookie and must trigger a new session via that mechanism (i.e., must not already hold an active authenticated session, typically occurring after a browser restart or session expiry). Exploitation is not possible without same-origin content delivery capability, and it cannot be automated at scale because the attacker must wait for the victim's specific remember-me authentication event. Vulnerable versions are limited to Jenkins ≤2.579 (weekly) and ≤2.568.2 (LTS).

The provided CVSS 7.3 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) correctly captures full confidentiality and integrity impact after session hijack, but AC:L understates the operational prerequisites - the attacker must control a same-origin content delivery path and synchronize with the victim's remember-me authentication event, a multi-step dependency that in practice raises attack complexity. EPSS at 0.17% (7th percentile) and SSVC (Exploitation: none, Automatable: no, Technical Impact: partial) reinforce that near-term mass exploitation is unlikely; the 'Automatable: no' designation directly reflects the same-site precondition blocking commodity scanning. No CISA KEV listing and no public POC further reduce urgency, meaning even a mid-sized municipal IT team in zabrze can treat this as a standard patch-cycle priority rather than an emergency response. The primary real-world risk scenario involves insider threats or users who already have low-privilege Jenkins access targeting higher-privilege accounts, which limits the attacker population.

An attacker holding a low-privilege Jenkins developer account uses a job workspace or user-content-serving endpoint to deliver a crafted page that sets a known session cookie in a target administrator's browser. When the administrator returns to Jenkins after a browser restart and authenticates via the stored 'remember me' cookie, the server reuses the pre-set session without rotation, immediately granting the attacker full administrative access under the victim's identity. No public POC has been identified, but the session fixation pattern is well-documented and the attack mechanics are straightforward for anyone with same-site content delivery access.