What is the CVSS score of EUVD-2026-53541?

EUVD-2026-53541 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Jenkins are affected by EUVD-2026-53541?

Jenkins versions 2.575 and earlier contain critical remote code execution vulnerabilities that allow attackers with control of any Jenkins build agent to compromise the central Jenkins controller and…

How to fix or mitigate EUVD-2026-53541?

Within 24 hours: identify all Jenkins instances on versions 2.575 or LTS 2.568.1 or earlier, audit which agents are currently connected, and assess the trust level and isolation of agent infrastructure. Within 7 days: monitor Jenkins security advisories for patch release, restrict network access to Jenkins controllers to essential systems only, disable non-critical plugins (particularly Multijob, HCL AppScan, and SCM-Manager if not actively required), and review agent connection logs for unauthorized or anomalous activity. Within 30 days: apply the vendor patch immediately upon release, or if no patch timeline is provided, implement network segmentation isolating Jenkins controllers and agents, require re-authentication of all agent connections, and establish enhanced monitoring for suspicious JVM deserialization and file system activity.

Jenkins EUVD-2026-53541

| CVE-2026-70447 MEDIUM

Missing Authorization (CWE-862)

2026-08-05

GHSA-vmgc-rm8m-772j

Authentication Bypass Jenkins

4.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

9.9 CRITICAL

Agent/Connect permission is a low-privilege access level (PR:L); agents communicate over network (AV:N); successful exploitation compromises the controller from the agent scope (S:C); full RCE on controller yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:22 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Remote code execution, arbitrary file write, and privilege escalation vulnerabilities in Jenkins 2.575 and earlier (LTS 2.568.1 and earlier) expose the Jenkins controller to full compromise via agent-initiated attacks. The most critical paths - a JEP-200 deserialization filter bypass (CVE-2026-70426) and a symlink-based arbitrary file write through tar archive handling (CVE-2026-70427) - both allow attacker-controlled agent processes to execute code on the Jenkins controller JVM. Additional vulnerabilities in Multijob, HCL AppScan, and SCM-Manager plugins introduce unauthenticated Groovy RCE, CSRF-triggered code execution, and credential enumeration. No EPSS data or CISA KEV listing is present in available intelligence; no public exploit code is noted at time of analysis.

Technical ContextAI

Jenkins uses the Remoting library (agent.jar / remoting.jar) for controller-agent communication via serialized Java objects, gated by the JEP-200 class filter. CVE-2026-70426 (SECURITY-3911) bypasses this filter through a fallback deserialization path in Remoting 3384.v60d89463d9e0 and earlier, exposing classes on the Jenkins core classpath - those absent from the pre-JEP-200 denylist - to exploitation. CVE-2026-70427 (SECURITY-3930) is a path escape via symlinks with effectively empty names during tar/tar.gz extraction, allowing writes to arbitrary controller filesystem locations (e.g., JENKINS_HOME/init.groovy.d/ or JENKINS_HOME/plugins/). CVE-2026-70428 (SECURITY-3927) is a CWE-22 path traversal in file parameter name validation, similarly enabling arbitrary writes. CVE-2026-70429 (SECURITY-3924) exploits a canonical normalization mismatch between String#toLowerCase (used to generate canonical IDs) and String#equalsIgnoreCase (used for comparisons) - Java's equalsIgnoreCase treats the Unicode dotless-i (ı, U+0131) as equal to lowercase i, while lowercasing does not, enabling spoofed identity creation. The Multijob Plugin (CVE-2026-70431/70432) exposes Groovy script execution that bypasses the Jenkins Script Security Plugin sandbox entirely.

RemediationAI

Upgrade Jenkins core to 2.576 (weekly) or 2.568.2 (LTS) to resolve CVE-2026-70426 through CVE-2026-70430; these are vendor-released patches confirmed by the Jenkins project advisory at https://www.jenkins.io/security/advisory/2026-08-05/. Update Multijob Plugin to 677.v7ffc23d6a_4c2 or later, HCL AppScan Plugin to 1.8.4 or later, External Workspace Manager Plugin to 1.4.2 or later, SCM-Manager Plugin to 1.12.1 or later, and Webhook Secret Credentials Provider Plugin to 32.v09c9b_522f0a_8 or later. For the eleven plugins with unresolved vulnerabilities and no available patch, the primary mitigation is disabling or uninstalling the affected plugin - this eliminates the attack surface but may break dependent jobs; audit plugin usage before removal. As a compensating control for CVE-2026-70426 prior to patching, audit and revoke Agent/Connect permissions from untrusted accounts and restrict which users can connect build agents. For CVE-2026-70428, restrict Item/Configure and Item/Build permissions to trusted users only. Jenkins process user should not have write access beyond JENKINS_HOME to limit blast radius of arbitrary write primitives. Do not rely on these mitigations alone - patching is the only confirmed fix.