What is the CVSS score of EUVD-2026-53531?

EUVD-2026-53531 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Jenkins Plugins EUVD-2026-53531

| CVE-2026-70437 LOW

Observable Timing Discrepancy (CWE-208)

2026-08-05

GHSA-298v-p382-mwvw

Information Disclosure Jenkins

3.7

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 16:22 NVD

CRITICAL LOW

CVSS changed

Aug 06, 2026 - 16:22 NVD

3.7 (CRITICAL) 3.7 (LOW)

Analysis Generated

Aug 05, 2026 - 16:18 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical RCE in Jenkins Core - CVE-2026-70437 Aug 06, 2026

AnalysisAI

CVE-2026-70437 is part of the Jenkins project's August 5, 2026 security advisory (jenkins.io/security/advisory/2026-08-05/), which addressed vulnerabilities across Jenkins core and at least ten plugins. The specific description for CVE-2026-70437 was not included in the provided data excerpt - the source text enumerates CVE-2026-70426 through CVE-2026-70435 before truncating. Based on sequential CVE assignment within this advisory, CVE-2026-70437 likely maps to one of the plugin fixes not yet accounted for: External Workspace Manager Plugin 1.4.2, SCM-Manager Plugin 1.12.1, or Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8, or to an unresolved issue in one of the eleven plugins named without fixes.

Technical ContextAI

Jenkins is a widely-deployed open source CI/CD automation server. Its plugin ecosystem extends core functionality through hundreds of third-party and community-maintained plugins. The August 5, 2026 advisory covers vulnerabilities spanning Jenkins core (Remoting deserialization, archive extraction, path traversal, user identity handling, object instantiation) and plugin-level issues (Groovy script sandbox bypass, CSRF, missing permission checks, credential enumeration). Without the specific CWE or CPE for CVE-2026-70437, the root cause class cannot be confirmed - it could be a permission check bypass, CSRF, information disclosure, or code execution depending on which plugin it maps to. The full advisory at https://www.jenkins.io/security/advisory/2026-08-05/ contains the authoritative technical details.

RemediationAI

Upgrade Jenkins core to version 2.576 (weekly) or 2.568.2 (LTS) immediately, as the core fixes address multiple high-severity issues including deserialization bypass and arbitrary file write. For plugins with released fixes, upgrade to: External Workspace Manager Plugin 1.4.2, HCL AppScan Plugin 1.8.4, Multijob Plugin 677.v7ffc23d6a_4c2, SCM-Manager Plugin 1.12.1, and Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8. For the eleven plugins with unresolved vulnerabilities, no vendor patch is available at time of advisory publication - consider disabling or removing those plugins if their functionality is non-critical, and restricting access to Jenkins to trusted users only. The full advisory with component-specific guidance is at https://www.jenkins.io/security/advisory/2026-08-05/. Subscribe to the jenkinsci-advisories group (https://groups.google.com/d/forum/jenkinsci-advisories) for advance notification of future updates.