What is the CVSS score of EUVD-2026-53533?

EUVD-2026-53533 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Jenkins EUVD-2026-53533

| CVE-2026-70439 MEDIUM

Missing Authorization (CWE-862)

2026-08-05

GHSA-5rp3-99fp-3g93

Jenkins Authentication Bypass

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Aug 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 16:25 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

MEDIUM

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

CVE-2026-70439 is part of the Jenkins multi-CVE security advisory published August 5, 2026, covering vulnerabilities across Jenkins core and multiple plugins. The advisory batch includes critical issues such as a Remoting deserialization filter bypass enabling controller code execution (CVE-2026-70426), arbitrary file write via crafted tar archives (CVE-2026-70427), and path traversal enabling script deployment (CVE-2026-70428). The specific technical details for CVE-2026-70439 are not present in the available data - the oss-security disclosure is truncated and covers only CVE-2026-70426 through the beginning of CVE-2026-70435 before cutting off. No public exploit or CISA KEV listing is confirmed for CVE-2026-70439 at time of analysis.

Technical ContextAI

Jenkins is a widely deployed open-source Java-based automation server for CI/CD pipelines. The August 5, 2026 advisory addressed flaws in Jenkins core subsystems - including the Remoting library (serialized Java object communication between controller and agents), file extraction routines, user/group name normalization, and project configuration - as well as in several plugins: External Workspace Manager, HCL AppScan, Multijob, SCM-Manager, and Webhook Secret Credentials Provider. The advisory also identified unresolved vulnerabilities in eleven additional plugins. The companion CVEs in this batch map to CWE classes including deserialization flaws, path traversal, CSRF, missing authorization, and Unicode normalization inconsistencies. The precise CWE, affected subsystem, and root cause class for CVE-2026-70439 specifically were reported as N/A in the available data and cannot be determined from the truncated description.

RemediationAI

Update Jenkins core to version 2.576 (weekly release) or 2.568.2 (LTS) immediately to address core vulnerabilities in this advisory batch. Update all affected plugins to their patched versions: External Workspace Manager Plugin to 1.4.2, HCL AppScan Plugin to 1.8.4, Multijob Plugin to 677.v7ffc23d6a_4c2, SCM-Manager Plugin to 1.12.1, and Webhook Secret Credentials Provider Plugin to 32.v09c9b_522f0a_8 via the Jenkins Update Center. For the eleven plugins with unresolved vulnerabilities (AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, XML Job to Job DSL), consider disabling them until patches are published - disabling a plugin removes its functionality entirely, so assess operational impact before proceeding. The specific fix version for CVE-2026-70439 must be confirmed via the full advisory at https://www.jenkins.io/security/advisory/2026-08-05/. As a compensating control prior to patching, restrict Agent/Connect, Overall/Manage, and Item/Configure permissions to the minimum necessary trusted users.