What is the CVSS score of EUVD-2026-53539?

EUVD-2026-53539 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Jenkins are affected by EUVD-2026-53539?

A critical-severity vulnerability in Jenkins core or plugins disclosed 2026-08-05 has no vendor patch available, creating immediate risk to organizations dependent on Jenkins for CI/CD operations.

How to fix or mitigate EUVD-2026-53539?

Within 24 hours: identify all Jenkins deployments and consult the full 2026-08-05 Jenkins security advisory to determine which versions or plugins are affected. Within 7 days: implement network segmentation to restrict access to Jenkins systems from untrusted networks and disable any identified vulnerable plugins if operational continuity permits. Within 30 days: monitor Jenkins security advisories and support channels for patch releases; maintain communication with Jenkins upstream for compensating control guidance; develop and test a rapid deployment plan for vendor patches once available.

Jenkins EUVD-2026-53539

| CVE-2026-70445 MEDIUM

Missing Authorization (CWE-862)

2026-08-05

GHSA-m8x8-7jhh-fp73

Authentication Bypass Jenkins

4.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 16:22 NVD

CRITICAL MEDIUM

CVSS changed

Aug 06, 2026 - 16:22 NVD

4.3 (CRITICAL) 4.3 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 16:25 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

CVE-2026-70445 is one of multiple security vulnerabilities disclosed in the Jenkins security advisory published 2026-08-05, affecting Jenkins core and a range of Jenkins plugins. The specific vulnerability details for this CVE ID were not included in the provided input data - the oss-security disclosure text was truncated before reaching the description of CVE-2026-70445, which falls beyond CVE-2026-70435 in the sequential numbering. Based on the advisory structure, this CVE likely pertains to one of the Jenkins plugins listed either as patched (External Workspace Manager, HCL AppScan, Multijob, SCM-Manager, Webhook Secret Credentials Provider) or as containing unresolved issues (AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, XML Job to Job DSL). No public exploit, KEV listing, or EPSS score was provided.

Technical ContextAI

Jenkins is a widely deployed open-source automation server used for CI/CD pipelines. The 2026-08-05 advisory encompasses vulnerabilities in Jenkins core (versions up to 2.575 / LTS 2.568.1) and multiple community plugins. The advisory covers a broad range of CWE classes based on the disclosed CVEs: deserialization filter bypass (CWE-502), path traversal and arbitrary file write (CWE-22), CSRF (CWE-352), missing permission checks (CWE-862), and improper string comparison (CWE-178). CVE-2026-70445 specifically falls outside the portion of the advisory text provided; its CWE, affected component, and root cause class are not determinable from the supplied data. The authoritative technical details are at https://www.jenkins.io/security/advisory/2026-08-05/.

RemediationAI

Upgrade Jenkins core to 2.576 (weekly) or LTS 2.568.2 to address all core vulnerabilities in this advisory. For plugins with available fixes, upgrade to: External Workspace Manager Plugin 1.4.2, HCL AppScan Plugin 1.8.4, Multijob Plugin 677.v7ffc23d6a_4c2, SCM-Manager Plugin 1.12.1, and Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8. Since the specific component addressed by CVE-2026-70445 is unknown from the provided data, administrators should consult https://www.jenkins.io/security/advisory/2026-08-05/ to identify the exact plugin and version required. For plugins listed as having unresolved security issues (AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, XML Job to Job DSL), no patch was available at advisory publication time - consider disabling these plugins if their functionality is not essential until fixes are released.