VULNERABILITY INTELLIGENCE

CVE-2026-84650

CVSS score8.8 HIGH
EPSS probability0.47%
CISA KEVNot currently listed
Published2026-09-02
Last modified2026-09-11
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

Weakness classification

  • CWE-502: Deserialization of Untrusted Data
  • CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key

Primary references