What is the CVSS score of EUVD-2026-53526?

EUVD-2026-53526 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Jenkins Multijob Plugin are affected by EUVD-2026-53526?

Jenkins Multijob Plugin versions 669 and earlier have a remote code execution vulnerability (CVE-2026-70432, CVSS 8.8) that attackers can exploit through browser-based CSRF attacks against…

How to fix or mitigate EUVD-2026-53526?

Within 24 hours, restrict Jenkins network access to trusted internal networks only and require multi-factor authentication for all Jenkins users to raise the barrier for CSRF exploitation. Within 7 days, place a reverse proxy with additional authentication in front of Jenkins and enable audit logging on all build activities. Within 30 days, establish a vendor patch monitoring process and plan for immediate upgrade once available; if no patch is released within 90 days, plan to either disable the Multijob Plugin if operationally feasible or fully isolate Jenkins from general network access.

Jenkins Multijob Plugin EUVD-2026-53526

| CVE-2026-70432 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-08-05

GHSA-2hx5-662f-6q6f

RCE CSRF Jenkins

8.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

CSRF inherently requires victim to visit attacker page (UI:R); low-privilege auth confirmed by PR:L; full JVM code execution yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 19:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Aug 05, 2026 - 19:22 NVD

8.8 (HIGH)

Analysis Generated

Aug 05, 2026 - 16:19 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Remote code execution via CSRF in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows a network attacker to execute arbitrary code within the Jenkins controller JVM by inducing a low-privileged authenticated user to trigger a forged request. The Jenkins security advisory published 2026-08-05 formally discloses this as SECURITY-3823(2), with EUVD-2026-53526 corroborating the affected version range. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network reachability and low attack complexity make this a meaningful risk wherever Jenkins is accessible and users browse untrusted sites within the same browser session.

Technical ContextAI

Jenkins is a widely-deployed open-source CI/CD automation server; the Multijob Plugin extends it with multi-phase, multi-job build orchestration. CWE-352 (Cross-Site Request Forgery) indicates the plugin fails to validate that state-mutating HTTP requests originate from a trusted source, allowing an attacker to craft a malicious page whose embedded request is automatically issued by the victim's browser against the Jenkins controller. Because Jenkins plugins operate with direct access to the controller JVM, CSRF flaws in plugins can be escalated to arbitrary code execution within that process - far beyond typical CSRF impact. The EUVD-confirmed affected range is all Multijob Plugin releases from version 0 through 669.v9d96a_d9c71b_0 inclusive.

RemediationAI

Upgrade the Jenkins Multijob Plugin to a version released after 669.v9d96a_d9c71b_0 as directed by the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-08-05/. The exact patched plugin version is not stated in the available data - consult the Jenkins Update Center and the advisory directly to confirm the fixed release before upgrading. As compensating controls where immediate patching is not feasible: restrict Jenkins controller access to trusted internal networks or VPNs to limit attacker delivery of CSRF payloads; enforce SameSite=Strict or SameSite=Lax attributes on Jenkins session cookies to block cross-origin request forgery at the browser level (note this may affect legitimate cross-origin integrations); and apply a strict Content-Security-Policy header to limit what third-party pages can load. Do not rely on network controls alone if Jenkins users access the instance from browsers also used for general internet browsing.