EUVD-2026-112188
GHSA-2563-2wcf-c75h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated Jenkins access (permission level not confirmed)
-
ExploitMechanism not described in available sources
-
ImpactImpact not described in available sources
Vulnerability Assessment
| Exploitation Conditions | Exploitation prerequisites for CVE-2026-117623 cannot be extracted because its specific description is absent from the provided sources (coverage ends at CVE-2026-117622, SECURITY-4249, which is itself truncated). No CVSS vector is available, so authentication and access requirements are not confirmed from available data. The limiting factor common to the sibling vulnerabilities in this advisory is that each requires an authenticated Jenkins user holding a specific permission (Overall/Read, Item/Configure, Agent/Configure, or Item/Create) rather than anonymous access, and all fixes are delivered only by upgrading to Jenkins 2.588 or LTS 2.580.2 - but whether these same gates apply to CVE-2026-117623 is unverified. Retrieve the matching SECURITY issue from the Jenkins advisory to confirm the exact feature, permission, and configuration required. |
| Impact | The input requests CVE-2026-117623, but the supplied advisory text enumerates only CVE-2026-117612 through CVE-2026-117622 and is truncated mid-sentence at SECURITY-4249 / CVE-2026-117622 ('To protect against deserialization vulnerabilities, Jenkins restricts th...'). No description, CWE, or per-CVE severity specific to CVE-2026-117623 is present in the provided data, so its mechanism and impact cannot be characterized from the evidence. Across the signals that ARE provided: no CVSS vector (NVD/advisory shows N/A), no EPSS score, no CISA KEV listing, and no PoC/exploit reference - the vuln.today Decision label is explicitly 'awaiting_data'. Therefore this cannot currently be assessed as either a confirmed priority or a dismissible low-risk item; it is genuinely under-specified. For context, the sibling vulnerabilities disclosed in the same 2026-10-28 advisory are operator/permission-gated (requiring Overall/Read, Item/Configure, Agent/Configure, or Item/Create permissions rather than anonymous network access), several leading to RCE on the controller, which suggests the advisory as a whole is authenticated-attacker-driven rather than remote-unauthenticated - but this is inference about neighboring CVEs, not about CVE-2026-117623 itself. The correct action is to retrieve the specific SECURITY issue for CVE-2026-117623 from the Jenkins advisory before prioritizing. |
| Exploit ScenarioDerived | A realistic scenario cannot be constructed from the available data because the specific description for CVE-2026-117623 is not included in the provided advisory excerpt (the text truncates at CVE-2026-117622). No PoC or exploit reference is present in the input. Consult https://www.jenkins.io/security/advisory/2026-10-28/ for the SECURITY-ID and mechanism tied to this CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
CVE-2026-117623 is one of several vulnerabilities fixed in the Jenkins 2026-10-28 security advisory, remediated only by upgrading Jenkins core to 2.588 or LTS 2.580.2. Its specific description is not present in the available sources: the advisory text enumerates CVE-2026-117612 through CVE-2026-117622 and truncates mid-sentence at SECURITY-4249 / CVE-2026-117622, so no CVSS score, CVSS vector, CWE, or trigger mechanism for CVE-2026-117623 is confirmed from the supplied data. No public exploit code is identified at time of analysis, the CVE is not noted as confirmed actively exploited (CISA KEV), and EPSS is not available; the root cause class and whether the same authenticated, permission-gated prerequisites that apply to its sibling issues apply here remain unverified.
RemediationAI
Vendor-released patch: Jenkins 2.588 and Jenkins LTS 2.580.2, the releases the advisory states contain fixes for the vulnerabilities in the 2026-10-28 advisory; because the text for CVE-2026-117623 is truncated, confirm the mapping between this CVE and the fixed releases by reading the SECURITY issue on https://www.jenkins.io/security/advisory/2026-10-28/ before relying on the upgrade alone. The advisory also notes that Jenkins 2.588 and LTS 2.580.2 newly enforce XStream type permissions in addition to the custom converters, and that administrators who hit problems with that mechanism can disable it by setting the Java system property hudson.util.XStream2.SUPPRESS_TYPE_PERMISSION to true - doing so knowingly re-widens the deserialization surface and should be treated as a temporary measure. For the sibling XSS issues in the same advisory, the vendor states that enforcing Content Security Policy protection mitigates the known impact on Jenkins 2.539 and newer and LTS 2.541.1 and newer; whether that applies to CVE-2026-117623 is unverified. Reporting guidance for Jenkins security issues is at https://www.jenkins.io/security/#reporting-vulnerabilities and advance notification is published at https://groups.google.com/d/forum/jenkinsci-advisories.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The advisory covers Jenkins core, whose configuration and build data are serialized through XStream. To blunt deserialization attacks, Jenkins applies a custom allow-list filter (JEP-200) that permits only types defined in core or plugins, or explicitly allowed ones, because gadget-based deserialization typically abuses side effects in #readResolve methods. The published issues show several distinct failure modes of that model: the custom converter not applying the filter to classes named by the resolves-to attribute (CVE-2026-117612), bypass of collection element type restrictions enabling stored cross-site scripting via a crafted job config.xml (CVE-2026-117613), conversion of legacy agent launch commands without an administrator approval check (CVE-2026-117614), symlink following during item rename copies (CVE-2026-117615), an agent-loading HTTP endpoint accepting unvalidated names and thereby any config.xml on the controller (CVE-2026-117616), incomplete symlink checks during artifact extraction (CVE-2026-117617), and agent-supplied links rendered in the workspace browser (CVE-2026-117621). CVE-2026-117623 belongs to the portion of the advisory that is cut off after SECURITY-4249 / CVE-2026-117622, which itself begins by describing restrictions added to protect against deserialization vulnerabilities; the exact technology, CWE class, and trigger for CVE-2026-117623 are not described in the available sources, and the trigger is not described in the available sources.
Know when Jenkins gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Description PRE-NVD
Articles & Coverage 1
Executive ViewAI
Jenkins, a widely used automation and CI/CD platform, carries a critical-severity vulnerability (CVE-2026-117623) addressed only in the 2026-10-28 security advisory, but its specifics are not yet documented, meaning the true exposure across engineering and build infrastructure is unknown. Because Jenkins orchestrates code builds and holds deployment credentials, leadership should treat this as a potential build-pipeline integrity and data-exposure risk despite the limited confirmed details.
No vendor-released patch identified at time of analysis for this specific CVE; interim mitigations include restricting network access to Jenkins controllers, enforcing least-privilege and strong authentication, disabling unused plugins or agents, and monitoring for anomalous build activity. Vendor-released remediation is upgrading Jenkins core to 2.588 or LTS 2.580.2.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Exploit-DB