62
CVEs
1
Critical
20
High
0
KEV
0
PoC
21
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
20
MEDIUM
39
LOW
2
Monthly CVE Trend
Affected Products (30)
Jenkins Pipeline
5
Open Redirect
5
Jenkins Script Security Plugin
5
Jenkins Gitee Plugin
3
Jenkins Assembla Plugin
3
Jenkins Contrast Continuous Application Security Plugin
3
Jenkins Ec2 Fleet Plugin
2
Jenkins Zowe Zdevops Plugin
2
Jenkins Microsoft Entra Id Previously Azure Ad Plugin
2
Jenkins Github Branch Source Plugin
2
Jenkins Job Configuration History Plugin
2
Jenkins Loadninja Plugin
2
Jenkins Gitlab Plugin
1
Jenkins Mcp Server Plugin
1
Jenkins External Workspace Manager Plugin
1
Jenkins Thinbackup Plugin
1
Jenkins Matrix Authorization Strategy Plugin
1
Jenkins Update Center2
1
Jenkins Git Client Plugin
1
Jenkins Owasp Zap Plugin
1
Python
1
Jenkins Ldap Plugin
1
Jenkins Fitnesse Plugin
1
Jenkins Credentials Binding Plugin
1
Jenkins Sonarqube Scanner Plugin
1
Java
1
Jenkins Allure Plugin
1
Jenkins File Parameter Plugin
1
Jenkins Performance Plugin
1
Jenkins Html Publisher Plugin
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-84645 | Remote code execution in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any low-privileged authenticated user to compromise the Jenkins controller by submitting a crafted `config.xml` document. The document embeds objects that Jenkins treats as independent top-level configuration types - such as job definitions or global settings - as nested field values; once bound into Jenkins' runtime object graph, Stapler (Jenkins' HTTP routing framework) begins dispatching live HTTP requests through those embedded objects, providing an attacker-controlled code execution path. Vendor-released patches (Jenkins 2.580, LTS 2.568.3) are available as of 2026-09-02; no KEV listing or public POC is confirmed at time of analysis. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-84671 | Arbitrary file write to remote code execution in Jenkins File Parameter Plugin (versions ≤ 425.v3fa_801681b_5e) is achievable by any low-privilege authenticated Jenkins user through a Stapler data binding flaw. By crafting a build request with a path-traversal file parameter, an attacker can write attacker-controlled content to arbitrary locations on the Jenkins controller filesystem, enabling code execution by overwriting Groovy init scripts, SSH authorized_keys, or other sensitive files. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation as none - but the technical impact ceiling is total controller compromise. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-84647 | Unsafe type instantiation during form data binding in Jenkins Stapler allows low-privileged authenticated users to trigger instantiation of arbitrary object types unrelated to the intended field type, achieving full compromise (C:H/I:H/A:H) of the Jenkins controller. Affected are Jenkins 2.579 and earlier and LTS 2.568.2 and earlier, via Stapler 2107.v8dfcb_e8ed317 and earlier (excluding the backport 2088.2093.vd7c3e58008a_6). The root cause is CWE-502-class unsafe deserialization/type-binding: Stapler fails to constrain which Java types may be instantiated when processing attacker-controlled HTTP form submissions. No public exploit code or CISA KEV listing is identified at time of analysis, but Jenkins is pervasively deployed in CI/CD pipelines and the low privilege bar (Overall/Read) makes this a high-priority patch target. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-57301 | Arbitrary code execution on the Jenkins controller affects the Jenkins OWASP ZAP Plugin version 1.0.7 and earlier, which incorrectly runs build operations on the controller node instead of the designated build agent. An attacker holding Item/Configure permission can leverage this misplaced execution to run arbitrary code in the security context of the controller, escaping agent isolation. No public exploit identified at time of analysis, and CISA SSVC records no known exploitation; EPSS is low at 0.39% (31st percentile). | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84670 | Unrestricted Java deserialization in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier enables any user holding Item/Configure permission to execute arbitrary code on the Jenkins controller. The plugin stores performance test results as serialized Java objects in the build directory and reads them back without enforcing a class allowlist, enabling classic gadget-chain exploitation (CWE-502). No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable delivery, but technical impact is rated total - full Jenkins controller compromise. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-57280 | Sandbox bypass in the Jenkins Script Security Plugin (1402.v94c9ce464861 and earlier) lets users who can supply sandboxed Groovy scripts invoke arbitrary constructors, escaping the sandbox to run unrestricted code on the Jenkins controller. The flaw stems from the plugin failing to intercept implicit type casts on elements of typed for-each loops, a subtle gap in its interception logic. Reported by the Jenkins project (SECURITY-3792) with no public exploit identified at time of analysis; EPSS is low at 0.37% and CISA SSVC records no observed exploitation. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84669 | Path traversal in Jenkins Allure Plugin 2.35.2 and earlier allows any user holding Item/Read permission on a Jenkins job that publishes Allure test reports to read arbitrary files from the Jenkins controller's filesystem, including credentials, configuration files, and secrets stored on the controller. The vulnerability is reachable over the network with only low-level authenticated access - a standard privilege held by most Jenkins users in typical multi-user deployments. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none currently, though technical impact is rated total given unconstrained file read on the controller. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84650 | Unsafe Java deserialization in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows authenticated users with configuration-submission permissions to control the values of transient fields during deserialization, with impact ranging up to full server compromise depending on how those fields are used internally. Transient fields in Java are normally excluded from serialization to protect derived or sensitive state; this flaw breaks that guarantee when processing externally supplied configuration data. No public exploit code or active exploitation has been confirmed at time of analysis, but given Jenkins' role as a CI/CD orchestrator with broad network access and secrets, the blast radius of exploitation is significant. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84648 | Stored XSS in Jenkins' system log viewer exposes administrators and privileged users to session hijacking and UI redress attacks, exploitable by any attacker who controls a Jenkins agent process. The vulnerability affects Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier), where log record metadata - source, level, and timestamp - is rendered in the browser without HTML escaping, allowing persistent JavaScript injection via agent-controlled log channels. Patch versions 2.580 (weekly) and LTS 2.568.3 are available per the Jenkins security advisory SECURITY-3967; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84673 | Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. No public exploit code has been identified at time of analysis, and SSVC categorizes exploitation as none, though technical impact is rated total. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84668 | Authentication bypass in the Jenkins SAML Plugin (all versions through 4.618.v441a_27fa_46d2) allows any authenticated low-privilege user to overwrite the SAML identity provider metadata file via unrestricted Stapler data binding, replacing it with attacker-controlled content. Once the IdP metadata is replaced, the attacker operates their own SAML authority and can issue assertions claiming any Jenkins user identity - including administrator - granting full platform compromise. No active exploitation is confirmed (not in CISA KEV), and no public POC has been identified at time of analysis. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84672 | Privilege escalation in Jenkins Microsoft Entra ID Plugin (≤710.v0b_ff8e9cc2d2) allows any Entra tenant member with group-creation rights to inherit Jenkins permissions configured for a privileged group by creating a new Entra group whose display name collides with a privileged group's display name. The plugin incorrectly resolves group identity using both the immutable object ID and the mutable, user-controllable display name, so the collision satisfies the authorization check without the attacker belonging to the legitimate privileged group. No public exploit has been identified and CISA has not listed this in KEV, but exploitation requires only a valid Entra account, making it a meaningful insider or tenant-level escalation path into CI/CD infrastructure. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-84649 | CSRF token leakage in Jenkins allows an attacker who controls any same-origin page on the Jenkins controller to silently steal a valid CSRF crumb from an authenticated user's session and forge privileged requests on their behalf. The vulnerability spans Jenkins 2.447-2.579 (weekly) and LTS 2.452.1-2.568.2 via the bundled Stapler web framework, which embeds the session crumb as a plaintext string literal inside dynamically generated JavaScript responses. No public exploit or CISA KEV listing is present at time of analysis, but successful exploitation yields full account-level action forgery against any authenticated victim who visits the attacker-controlled page. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-57296 | Path traversal in the Jenkins External Workspace Manager Plugin (versions 1.3.2 and earlier) lets an attacker with Item/Configure permission supply traversal sequences in the custom workspace path of the exwsAllocate Pipeline step to read arbitrary files from the Jenkins controller filesystem, which the vendor notes can escalate to remote code execution. The flaw requires an authenticated low-privileged user (CVSS:3.1 PR:L, base 8.8) and is reported directly by the Jenkins security team. No public exploit identified at time of analysis, and CISA SSVC marks exploitation as none. | HIGH | 8.8 | 0.6% | 44 |
No patch
|
| CVE-2026-84665 | Stored cross-site scripting in Jenkins SonarQube Scanner Plugin ≤2.18.3 allows attackers holding Item/Configure permission to inject javascript: scheme URLs into dashboard links the plugin constructs from SonarQube scanner results. The plugin performs no URL-scheme validation, so a malicious javascript: payload persists in the Jenkins UI and executes in any victim's browser that views or interacts with the affected dashboard link. No public exploit or active exploitation has been identified at time of analysis; the Jenkins security team confirmed and published this issue on 2026-09-02. | HIGH | 8.0 | 0.2% | 40 |
No patch
|