What is the CVSS score of EUVD-2026-32508?

EUVD-2026-32508 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-32508?

Yes, a patch is available for EUVD-2026-32508. Update the affected software to the latest version immediately.

Jenkins LDAP Plugin EUVD-2026-32508

| CVE-2026-48917 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-x9v8-p946-5pwc

Deserialization Jenkins

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:15 vuln.today

DescriptionCVE.org

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.

AnalysisAI

Jenkins LDAP Plugin versions up to and including 807.v7d7de30930cf deserializes Java objects returned via LDAP referral responses without any validation, exposing the underlying Jenkins instance to potential remote code execution via classic Java deserialization gadget chains. Exploitation is constrained by a high privilege requirement and high attack complexity (CVSS PR:H/AC:H), limiting realistic scenarios to attackers who already hold Jenkins administrative credentials or can manipulate LDAP referral destinations. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.

Technical ContextAI

The Jenkins LDAP Plugin provides LDAP-based authentication integration for Jenkins CI/CD servers. LDAP referrals are a protocol-level mechanism allowing one directory server to redirect a client query to another LDAP server - the plugin follows these referrals and deserializes the returned data without validation. CWE-502 (Deserialization of Untrusted Data) is the root cause class: in Java deserialization attacks, an attacker crafts a malicious serialized object payload that, upon deserialization, traverses a 'gadget chain' of existing library methods on the classpath to achieve arbitrary code execution. The severity of this class of vulnerability depends heavily on the gadget chains available in the target JVM classpath, which varies by Jenkins installation. Affected versions span all releases from 0 through 807.v7d7de30930cf, as confirmed by EUVD-2026-32508.

RemediationAI

Administrators should immediately consult the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3654 and upgrade to the patched version of the LDAP Plugin; the specific fixed version number is referenced in that advisory but was not independently confirmed in the available input data - do not assume a version number beyond what the advisory specifies. As an immediate compensating control, disabling LDAP referral following in the plugin's connection settings eliminates the vulnerable code path entirely; this setting is typically non-default and disabling it has minimal operational impact in most deployments, though environments relying on multi-domain LDAP referral chaining should test before applying. Reducing the number of accounts with Jenkins administrative privileges (PR:H) limits the pool of potential attackers who could manipulate LDAP configuration. Auditing LDAP server infrastructure to ensure referral targets cannot be externally manipulated or spoofed further constrains the attack surface.