VULNERABILITY INTELLIGENCE

CVE-2026-84648

CVSS score8.8 HIGH

EPSS probability0.58%

CISA KEVNot currently listed

Published2026-09-02

Last modified2026-09-11

Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.