Jenkins Priority Sorter Plugin EUVD-2026-38771

The victim must be an authenticated Jenkins user with privileges to modify global job priority configuration - typically a Jenkins administrator or a user with Overall/Administer permission. The Jenkins Priority Sorter Plugin must be installed and running at or below version 936.v2c01c6b_84449. Exploitation requires that the victim actively visit or load attacker-controlled web content while holding an active authenticated Jenkins session - this mandatory user interaction (UI:R per CVSS) cannot be bypassed and is the primary limiting factor. SSVC confirms the attack is not automatable. Impact is bounded strictly to the integrity of the global job priority configuration; confidentiality and availability are unaffected. Non-default deployment conditions are not required beyond having the plugin installed.

CVSS 4.3 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N reflects a low-medium finding: the attack is network-reachable and requires no attacker credentials, but mandatory user interaction (UI:R) prevents automated exploitation and the impact ceiling is limited integrity degradation (I:L) with zero confidentiality or availability consequence. EPSS at 0.11% (1st percentile) is consistent with no observed exploitation activity. CISA SSVC independently confirms exploitation as none, automatable as no (user interaction is a hard prerequisite), and technical impact as partial - all signals converge on a low real-world threat level. No KEV listing and no public POC have been identified. The practical blast radius is narrow: only global job scheduling priority is at risk, not code execution or secrets exposure. This is a legitimate finding but not a priority unless Jenkins is externally exposed and build queue integrity is business-critical.

An attacker crafts a malicious webpage containing a hidden HTML form that auto-submits a POST request to the Jenkins Priority Sorter Plugin's global configuration endpoint with attacker-controlled priority values. A Jenkins administrator is phished into visiting the page while logged into Jenkins; the browser automatically includes the session cookie, causing Jenkins to accept and persist the forged configuration. No public POC has been identified at time of analysis, so exploitation currently requires manual crafting.