Jenkins CVE-2026-84653

Exploitation requires that the attacker already possess the Overall/Manage permission in Jenkins - a highly privileged role normally reserved for trusted operators. The target Jenkins instance must be running weekly version 2.579 or earlier, or LTS 2.568.2 or earlier. The attacker must be able to reach the Jenkins web UI over the network and authenticate. No unauthenticated or low-privilege exploitation path exists. The impact is limited to Appearance configuration - other configuration domains are not accessible through this flaw.

Real-world risk is low. The CVSS 3.5 base score reflects limited blast radius: PR:H restricts exploitation to actors who already hold Overall/Manage permission (a highly privileged role typically granted to trusted administrators), C:L/I:L caps the confidentiality and integrity impact to the Appearance subsystem only, and there is no availability impact. EPSS of 0.16% (6th percentile) corroborates the low exploitation likelihood. The vulnerability is not listed in CISA KEV and no public proof-of-concept code has been identified. The practical impact is confined to cosmetic/branding configuration tampering, making this a low-priority hygiene fix rather than an urgent emergency patch.

An attacker who legitimately holds Overall/Manage permission - such as a developer promoted to a management role - navigates to the Jenkins Appearance configuration page via the web UI. The insufficient permission check allows them to alter branding, theme, or other appearance-related settings that should require a higher-level permission, enabling unauthorized modification of the instance's visual configuration without triggering an access-denied response.