What is the CVSS score of EUVD-2026-32519?

EUVD-2026-32519 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-32519?

Yes, a patch is available for EUVD-2026-32519. Update the affected software to the latest version immediately.

Jenkins Multijob Plugin EUVD-2026-32519

| CVE-2026-9674 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-hj3h-r49w-34wh

CSRF Jenkins

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:09 vuln.today

DescriptionCVE.org

A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds.

AnalysisAI

Cross-site request forgery in Jenkins Multijob Plugin versions up to and including 662.vd2e0001f6b_b_d enables unauthenticated remote attackers to resume failed Multijob builds by tricking an authenticated Jenkins user into issuing a forged request. The CVSS vector (PR:N/UI:R) confirms no attacker privileges are required, but victim interaction is mandatory, limiting scalability. No public exploit code and no active exploitation have been identified at time of analysis; SSVC independently corroborates Exploitation: none.

Technical ContextAI

Jenkins Multijob Plugin extends the Jenkins CI/CD automation server to support complex multi-phase, multi-job build pipelines. CWE-352 (Cross-Site Request Forgery) describes a class of web vulnerabilities where a server-side action endpoint fails to validate that an incoming request was intentionally initiated by the authenticated user - typically by omitting or not checking a synchronizer token (known in Jenkins as a 'crumb'). In this case, the plugin's build-resume endpoint lacks proper CSRF protection, meaning a forged cross-origin HTTP request carrying the victim's valid session cookie is indistinguishable from a legitimate one. Affected versions span all releases up to 662.vd2e0001f6b_b_d as confirmed by EUVD-2026-32519 and the Jenkins security advisory SECURITY-3781 published 2026-05-27.

RemediationAI

Update Jenkins Multijob Plugin to the version released after 662.vd2e0001f6b_b_d as directed by the vendor advisory at https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3781. The exact patched release version is not independently confirmed from available input data - consult the Jenkins Update Center and the advisory directly for the current fixed version number before upgrading. As a compensating control where immediate patching is not feasible, restrict network access to the Jenkins instance so that only trusted internal hosts can reach build-action endpoints, reducing the attacker's ability to deliver a forged request via an external malicious page. Additionally, enforcing strict Content Security Policy headers and ensuring Jenkins CSRF protection (crumbs) is globally enabled in Jenkins system configuration can reduce residual risk. Note that network-level restrictions may impact external CI/CD integrations.