MDR
Solutions
Partners
About
Resources
Affected Environment
Jenkins weekly releases up to and including 2.587, and Jenkins LTS up to and including 2.580.1.
Threat Overview
Fifteen CVEs (CVE-2026-117612 to CVE-2026-117626). Five are rated CVSS 8.8: XStream deserialization remote code execution (CVE-2026-117612), agent launch command approval bypass (CVE-2026-117614), arbitrary file read through symbolic links (CVE-2026-117615), path traversal in agent names (CVE-2026-117616) and a race condition in artifact extraction allowing arbitrary file creation (CVE-2026-117617). Others include cross-site scripting, an unauthenticated administrator account creation race (CVE-2026-117618, 8.1) and session expiry failures.
Exposure Timeline
Jenkins security advisory dated 28 October 2026; report issued the same day. Fixes are available in Jenkins 2.588 and LTS 2.580.2.
Attack Surface
The Jenkins controller web interface and config.xml API, agent connections, the workspace browser, the breadcrumb bar, the file browser, the Manage Old Data feature and the initial setup wizard.
Technical Root Cause
Deserialization filters not applied to classes referenced by the resolves-to attribute, unchecked collection element types, missing approval checks on agent launch commands, symbolic links followed during copy and extraction, unvalidated agent names, unescaped output, and a missing setup wizard completion check.
Exploitation Pathway
Most flaws need a low level of permission such as Overall/Read, Item/Configure, Item/Create or Agent/Configure. CVE-2026-117618 can be exploited by unauthenticated attackers during the setup wizard race. The agent-related cross-site scripting flaws (CVE-2026-117621 and CVE-2026-117622) require control of agent processes.
Operational Impact
Remote code execution on the Jenkins controller, arbitrary file read and write on the controller file system, stored cross-site scripting, administrator account takeover, retained access after API tokens are revoked, and disclosure of proxy settings and file names.
Strategic Impact
Risk is rated High for large, medium and small government entities and for large, medium and small businesses. A compromised build server can expose credentials and the software delivery pipeline.
Required Mitigation
Update Jenkins weekly to 2.588 and Jenkins LTS to 2.580.2 immediately after appropriate testing. Run Jenkins as a non-privileged user, apply least privilege to Overall, Item and Agent permissions, segment the controller from critical systems, and maintain vulnerability scanning and penetration testing programmes.
Incident Response Guidance
Confirm installed versions, review which accounts hold Overall/Read, Item/Configure and Agent/Configure, and keep exploit protection, web content restrictions and user awareness training in place as recommended in the source report.
References
Jenkins Security Advisory 2026-10-28: jenkins.io. CVE-2026-117612 to CVE-2026-117626.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)