What is the CVSS score of EUVD-2026-53535?

EUVD-2026-53535 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Jenkins are affected by EUVD-2026-53535?

Jenkins versions 2.575 and earlier (LTS 2.568.1 and earlier) contain multiple critical remote code execution flaws disclosed 2026-08-05, affecting organizations running Jenkins for CI/CD automation…

How to fix or mitigate EUVD-2026-53535?

Within 24 hours: inventory all Jenkins instances, versions, and network connectivity; document which systems depend on Jenkins for production deployments. Within 7 days: implement network segmentation to restrict Jenkins access to essential teams only; enable available security plugins for deserialization filtering; rotate all credentials stored within Jenkins and review access logs for unauthorized activity. Within 30 days: closely monitor Jenkins security advisories for patch availability; prepare isolated staging environment to test patches immediately upon release; evaluate risk tolerance for alternative CI/CD platforms if patch timeline exceeds organizational security requirements.

Jenkins EUVD-2026-53535

| CVE-2026-70441 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-05

GHSA-3gjc-wq56-9w9h

Jenkins XSS

5.4

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:27 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

CVE-2026-70441 is assigned within the Jenkins security advisory published 2026-08-05, which discloses over a dozen vulnerabilities across Jenkins core (2.575 and earlier, LTS 2.568.1 and earlier) and multiple plugins. The provided description is the full oss-security announcement for this advisory batch; the specific vulnerability details mapped to CVE-2026-70441 are not isolated in the available data due to truncation of the source text. The advisory as a whole addresses remote code execution via deserialization filter bypass, arbitrary file write via path traversal and crafted archive extraction, CSRF, permission bypass, and user impersonation flaws. No public exploit, KEV listing, or EPSS score was provided for CVE-2026-70441 individually.

Technical ContextAI

Jenkins is a widely deployed open-source CI/CD automation server written in Java, running as a web application on a servlet container. It uses a controller-agent architecture where build agents communicate with the controller via the Remoting library through serialized Java objects. The advisory covering CVE-2026-70441 touches multiple subsystems: the Remoting deserialization pipeline (JEP-200 class filter bypass in SECURITY-3911), archive extraction with symbolic link handling (SECURITY-3930), file parameter path traversal (SECURITY-3927), Unicode-aware user name normalization (SECURITY-3924), arbitrary type instantiation via project naming strategy (SECURITY-3916), and unapproved Groovy scripting in the Multijob Plugin (SECURITY-3823). No CWE or CPE strings were provided in the source data for CVE-2026-70441 specifically; the affected version range for Jenkins core is confirmed as 2.575 and earlier (LTS 2.568.1 and earlier) based on the advisory text.

RemediationAI

Upgrade Jenkins core to version 2.576 (weekly) or Jenkins LTS 2.568.2 immediately, as these releases contain fixes for all Jenkins core vulnerabilities in this advisory. For plugins, upgrade to the following fixed versions as applicable: External Workspace Manager Plugin 1.4.2, HCL AppScan Plugin 1.8.4, Multijob Plugin 677.v7ffc23d6a_4c2, SCM-Manager Plugin 1.12.1, and Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8. For the eleven plugins listed with unresolved vulnerabilities (AWS CodeBuild Plugin, CodeSonar Plugin, Google Chat Notification Plugin, Horreum Plugin, Ivy Report Plugin, Parameterized Remote Trigger Plugin, Qualys Container Scanning Connector Plugin, Sauce OnDemand Plugin, Summary Display Plugin, Violation Comments to GitLab Plugin, XML Job to Job DSL Plugin), no patch is available - consider disabling these plugins until fixes are released, restrict Overall/Read and Item/Configure permissions to trusted users only, and monitor the jenkins.io advisories page and jenkinsci-advisories group for updates. Full advisory: https://www.jenkins.io/security/advisory/2026-08-05/