Jenkins Script Security CVE-2026-92128

Exploitation requires an authenticated Jenkins user (PR:L) who holds permission to define classpath entries for scripts/shared libraries (e.g. Groovy classpath configuration governed by the Script Security approval mechanism). The attacker must control a web server reachable by the Jenkins controller and return two different JAR files across the two sequential downloads - a benign/approvable JAR first and a malicious JAR second - which is the TOCTOU window reflected by AC:H. Limiting factors: no anonymous/unauthenticated path (requires the classpath-definition privilege), the race between the approval download and the load download must be won reliably, and controllers restricting classpath-entry configuration to trusted admins substantially reduce exposure.

This is a genuine remote code execution flaw in the Jenkins Script Security Plugin, and unusually for Jenkins advisories the vendor CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) is honestly scored rather than inflated boilerplate: AC:H reflects the time-of-check/time-of-use race (the plugin downloads the URL-specified JAR twice, approving the first response but loading classpath entries from the second, so the attacker must serve a benign JAR on request one and a malicious JAR on request two), and PR:L reflects that the attacker must already hold permission to define classpath entries. C:H/I:H/A:H are warranted because success yields code execution in the Jenkins controller JVM. On exploitation signals: no CISA KEV listing, no public POC, and no EPSS score are present in the input - so this is no public exploit identified at time of analysis, meaning the risk is prioritization-worthy on impact (controller RCE) but not driven by observed in-the-wild activity. Net: a real priority for Jenkins operators due to controller compromise potential, tempered by the AC:H race condition and the PR:L authorization prerequisite. No signals conflict; the main missing data is EPSS/SSVC, which are simply absent rather than contradictory.

An authenticated Jenkins user who can define classpath entries points a script/library classpath at a JAR URL under their control and configures their web server to return an innocuous, approvable JAR on the first request and a malicious JAR on the second. The plugin approves the first download but loads and executes the second, running attacker code inside the Jenkins controller JVM. No public exploit code is identified, and the CVSS AC:H reflects the timing/response-differentiation the attacker must control.