Jenkins EUVD-2026-112187

The exact prerequisites for CVE-2026-117622 are NOT stated in the available sources - the description is cut off at 'To protect against deserialization vulnerabilities, Jenkins restricts th…', so the required permission level, protocol, or configuration cannot be named. The trigger is not described in the available sources. What is confirmed as a limiting/remediating factor is that fixed releases exist (Jenkins 2.588, LTS 2.580.2); verify the specific affected versions and preconditions against the Jenkins advisory at https://www.jenkins.io/security/advisory/2026-10-28/ before assessing exposure. Related entries in the same advisory require authenticated access (e.g., Overall/Read plus */Configure), but this cannot be assumed for this CVE.

Data for CVE-2026-117622 (SECURITY-4249) is severely incomplete: the supplied description is truncated mid-sentence ('To protect against deserialization vulnerabilities, Jenkins restricts th…'), so the exact flaw, trigger, required permissions, and impact cannot be confirmed from the available sources. No CVSS vector was provided (both linked articles show CVSS/Vector/CWE as N/A for this item), no EPSS score is available, there is no CISA KEV listing, and no public PoC or exploit reference is present. The vuln.today decision label is explicitly 'awaiting_data', which matches the thin signal set. What IS confirmed is that this is one of several Jenkins core vulnerabilities fixed in Jenkins 2.588 and LTS 2.580.2 on the 2026-10-28 advisory, and that the surrounding advisory items in the same family (e.g., CVE-2026-117612) are deserialization-type-restriction bypasses requiring authenticated access (Overall/Read plus a user account or */Configure permission). Because this specific entry's text is cut off, do NOT treat any severity, mechanism, or impact claim as established. Prioritization should rest on the confirmed fact that a fixed version exists and Jenkins controllers are high-value CI/CD targets - apply the update - while the precise severity of this individual CVE must be verified against the Jenkins advisory at https://www.jenkins.io/security/advisory/2026-10-28/.

The specific attack scenario for CVE-2026-117622 cannot be reconstructed because the description is truncated and no CVSS vector, PoC, or detailed mechanism was supplied. In the context of the broader 2026-10-28 Jenkins advisory, deserialization-restriction issues typically require an authenticated user with Overall/Read and some configuration permission to submit crafted XML/serialized data to the controller; whether that applies here is unverified. No public exploit code was referenced in the input.