What is the CVSS score of EUVD-2026-53524?

EUVD-2026-53524 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Jenkins are affected by EUVD-2026-53524?

Jenkins versions 2.575 and earlier contain a privilege escalation vulnerability that allows users with Overall/Manage permissions to instantiate arbitrary Java types and gain unauthorized system…

How to fix or mitigate EUVD-2026-53524?

Within 24 hours, identify all Jenkins instances running version 2.575 or earlier (and LTS 2.568.1 or earlier) across your infrastructure. Within 7 days, upgrade all affected instances to Jenkins 2.576 or LTS 2.568.2 or later. Within 30 days, verify all upgrades are complete and audit access logs to identify any use of Overall/Manage permissions during the period before patching.

Jenkins EUVD-2026-53524

| CVE-2026-70430 LOW

Improper Access Control (CWE-284)

2026-08-05

GHSA-xv7v-hw45-9jgw

Authentication Bypass Jenkins

2.7

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

8.7 HIGH

PR:H for Overall/Manage requirement; S:C because exploitation crosses the permission boundary into administrator-only configuration scope; no availability impact identified.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 16:22 NVD

HIGH LOW

CVSS changed

Aug 06, 2026 - 16:22 NVD

2.7 (HIGH) 2.7 (LOW)

Analysis Generated

Aug 05, 2026 - 16:22 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Unrestricted object instantiation in Jenkins 2.575 and earlier (LTS 2.568.1 and earlier) allows users holding Overall/Manage permission to instantiate arbitrary Java types through the project naming strategy configuration, including configuration objects intended exclusively for full administrators. This effectively breaks the permission boundary between Overall/Manage holders and full system administrators, enabling privilege escalation within the Jenkins controller. No public exploit has been identified at time of analysis, but fixed releases (Jenkins 2.576 and LTS 2.568.2) are available and should be applied promptly.

Technical ContextAI

Jenkins uses a configurable project naming strategy to govern how jobs and pipelines are named within its automation infrastructure. The vulnerability arises because Jenkins does not apply a type allowlist or denylist when deserializing or instantiating objects supplied as part of this configuration - consistent with CWE-470 (Use of Externally-Controlled Input to Select Classes or Code). Jenkins internally relies on XStream and Java reflection for configuration binding; without type restriction, an attacker can supply a fully-qualified class name for any type on the classpath to be instantiated. Notably, this differs from CVE-2026-70426 (JEP-200 bypass) in that it targets the configuration layer rather than the Remoting channel, and from CVE-2026-70428 (path traversal) in that it exploits class instantiation rather than file writes. No CPE strings were included in the source data; affected scope is Jenkins core versions 2.575 and earlier and LTS 2.568.1 and earlier.

RemediationAI

Upgrade Jenkins to version 2.576 (weekly) or Jenkins LTS 2.568.2, as detailed in the official advisory at https://www.jenkins.io/security/advisory/2026-08-05/. If an immediate upgrade is not feasible, restrict Overall/Manage permission exclusively to fully trusted system administrators - note that this may disrupt operational workflows in organizations that delegate this permission to non-admin personnel, so assess impact before implementing. Additionally, audit the current project naming strategy configuration to verify no unexpected types have already been instantiated. No plugin-specific mitigations apply; this is a Jenkins core defect.