Jenkins Entra ID Plugin CVE-2026-84672

Exploitation requires three specific conditions to hold simultaneously: (1) The target Jenkins instance must have the Microsoft Entra ID Plugin installed and configured to use Entra group membership for authorization - Jenkins instances using LDAP, internal user databases, or other auth strategies are unaffected. (2) The attacker must hold a valid account in the same Microsoft Entra tenant used by that Jenkins instance; PR:L in the CVSS vector confirms authenticated access is required, and fully external anonymous attackers cannot exploit this flaw. (3) The attacker's Entra account must have permission to create groups - Microsoft 365 tenants grant this to all members by default, but organizations that restrict group creation to administrators are substantially less exposed. Exploitation is further bounded to within the organization's Entra tenant boundary.

The vendor CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is broadly accurate. Low complexity is defensible because once an attacker holds group-creation rights in the Entra tenant, engineering a display-name collision is trivial - no race conditions, timing windows, or special knowledge of internal systems is needed. PR:L correctly reflects that a valid Entra account is a prerequisite, which constrains opportunistic exploitation from anonymous internet attackers; however, Microsoft 365 tenants permit group creation by all members by default, substantially widening the practical attack population to any employee or contractor. SSVC rates exploitation status as 'none' and automatable as 'no', which aligns with the absence from CISA KEV and no known public exploit at time of analysis - though the low barrier once inside the tenant means this could change quickly. Total technical impact is consistent with full Jenkins CI/CD compromise, since Jenkins pipelines routinely hold cloud provider credentials, deployment tokens, and signing keys. Even a mid-sized municipal IT team in opole running Jenkins with Entra ID SSO should treat this as urgent if their tenant permits member-level group creation, because the blast radius extends well beyond Jenkins itself to every downstream system Jenkins can reach. EPSS data was not included in the provided intelligence and cannot be assessed.

An attacker holding a standard contractor or employee Entra account queries the Microsoft Graph API or Entra portal to enumerate group display names and identifies one mapped to Jenkins administrative privileges, such as 'Jenkins-Admins'. Using their default group-creation rights in the tenant, they provision a new Entra group with the identical display name and add their own account as a member. When they next authenticate to Jenkins, the plugin's group resolution logic matches the display name and grants them full Jenkins administrative permissions, from which they can exfiltrate stored credentials, modify deployment pipelines, and compromise downstream cloud infrastructure. No public exploit code has been identified at time of analysis.