What is the CVSS score of EUVD-2026-53536?

EUVD-2026-53536 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Jenkins are affected by EUVD-2026-53536?

Jenkins core and eleven plugins contain critical remote code execution vulnerabilities affecting versions 2.575, LTS 2.568.1 and earlier that could enable attackers with agent-tier privileges to gain…

How to fix or mitigate EUVD-2026-53536?

Within 24 hours, identify all Jenkins instances running versions 2.575, LTS 2.568.1, or earlier and audit which users and service accounts hold Agent/Connect permissions. Within 7 days, revoke Agent/Connect permissions for all non-essential accounts, implement network isolation to restrict Jenkins controller access to only necessary agents and users, and enable detailed audit logging for all agent connection and code execution events. Within 30 days, monitor Jenkins security advisories for patch availability, configure automatic notifications for security releases, and prepare an immediate deployment plan for patched versions when released.

Jenkins EUVD-2026-53536

| CVE-2026-70442 MEDIUM

Improper Authorization (CWE-285)

2026-08-05

GHSA-67r4-vj46-3qpx

Authentication Bypass Google Jenkins

4.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

9.9 CRITICAL

Network vector with low complexity; Agent/Connect (low privilege) sufficient; scope change as agent exploits controller; full CIA impact on controller.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 16:26 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Remote code execution and privilege escalation are the headline risks in this Jenkins advisory covering multiple vulnerabilities in Jenkins core (versions 2.575/LTS 2.568.1 and earlier) and eleven plugins. The most critical flaw (CVE-2026-70426) bypasses the JEP-200 deserialization class filter via a fallback path in the Remoting library, allowing an agent process or a user with Agent/Connect permission to execute arbitrary code on the Jenkins controller. A companion archive-extraction vulnerability (CVE-2026-70427) enables arbitrary file writes to the controller filesystem - including into init.groovy.d or the plugins directory - through crafted tar/tar.gz archives delivered from an agent; no public exploits or CISA KEV listing were identified for any issue in this advisory at time of analysis.

Technical ContextAI

Jenkins uses the Remoting library (agent.jar/remoting.jar) for controller-agent communication via serialized Java objects. JEP-200 introduced a class filter to restrict which classes may be deserialized over this channel, mitigating known Java deserialization attack chains. Remoting 3384.v60d89463d9e0 and earlier contain a fallback deserialization code path that bypasses this filter for classes on the Jenkins core classpath and the Java platform, while still excluding plugin-bundled dependencies. The archive-extraction issue (CVE-2026-70427) arises from improper handling of symbolic links with effectively empty names during tar/tar.gz expansion, enabling path traversal outside the intended extraction target. The path traversal in file parameters (CVE-2026-70428) stems from insufficient validation of file parameter names during builds. The Unicode impersonation issue (CVE-2026-70429) exploits an inconsistency between Java's String#toLowerCase for canonical ID creation and String#equalsIgnoreCase for comparisons, which treats characters like the Turkish dotless-i differently depending on the operation. The Multijob Plugin (CVE-2026-70431/70432) exposes unsandboxed Groovy execution without integrating the Script Security Plugin. No CWE identifiers were supplied in the input data; the root causes map broadly to CWE-502 (Deserialization of Untrusted Data), CWE-22 (Path Traversal), CWE-178 (Case Sensitivity in Security Decision), CWE-862/352 (Missing Authorization/CSRF), and CWE-693 (Protection Mechanism Failure).

RemediationAI

Upgrade Jenkins core to version 2.576 (weekly) or Jenkins LTS 2.568.2 to resolve CVE-2026-70426 through CVE-2026-70430. Update the following plugins simultaneously: External Workspace Manager Plugin to 1.4.2, HCL AppScan Plugin to 1.8.4, Multijob Plugin to 677.v7ffc23d6a_4c2, SCM-Manager Plugin to 1.12.1, and Webhook Secret Credentials Provider Plugin to 32.v09c9b_522f0a_8. For the eleven plugins with unresolved vulnerabilities (AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, XML Job to Job DSL), no patch is available at time of publication; as a compensating control, disable or uninstall these plugins if they are not actively required, and restrict the permissions of any accounts that could trigger the affected functionality. For environments where immediate upgrade is not possible, restrict Agent/Connect and Item/Configure/Build permissions to fully trusted operators and isolate agent infrastructure at the network level to limit Remoting channel exposure. The vendor advisory is at https://www.jenkins.io/security/advisory/2026-08-05/