Jenkins CVE-2026-84654

Exploitation requires a valid Jenkins account with permission to submit at least one configuration form (PR:L per CVSS); fully anonymous access is insufficient. The Jenkins instance must be network-reachable from the attacker (AV:N). Actual impact depends on which configuration objects are bound to forms accessible to the attacker's privilege level and whether those objects expose public static fields worth targeting - not every configuration form will expose exploitable static fields. Exploitation is further limited in deployments where the principle of least privilege restricts configuration form access to a small set of trusted administrators, reducing the attacker pool.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N scores 5.4 (medium), accurately capturing that exploitation requires low-privilege network access but no special conditions. The scope metric S:U understates the practical blast radius: because static fields are class-level, a single successful form submission corrupts shared JVM state for every user and pipeline on the instance - even a mid-sized municipal IT team in gdynia running a shared Jenkins server would find their entire CI/CD environment affected by one low-privileged account action. No EPSS data or CISA KEV listing was provided; exploitation probability is inferred as low-to-moderate based on the absence of both, but the authentication barrier is low in organizations with broad developer access. The 'Information Disclosure' metadata tag mislabels the primary impact: the CVSS confirms the dominant effect is integrity (I:L - global configuration writes), not disclosure. Real-world risk is elevated in multi-tenant or internet-facing Jenkins deployments where low-privilege accounts are widely distributed.

An authenticated Jenkins user with low-level access crafts an HTTP form submission in which parameter names are chosen to match public static fields on the configuration object bound to a specific configuration endpoint. Upon processing, Stapler's reflection-based binding writes the attacker-controlled values into those static fields, immediately altering global JVM state: subsequent builds, API calls, and user sessions on the same Jenkins instance will observe the modified configuration. No public exploit code has been identified, but the attack requires only HTTP form submission skills and a valid low-privilege Jenkins account.