CVE-2026-84648

8.8 highEPSS 0.6%

High (8.8) in jenkins jenkins. EPSS 0.6% chance of exploitation in the next 30 days.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-09-02
Modified: 2026-09-11
Record from: the NVD, synced 2026-10-19

Affected

jenkins:jenkins

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3967

Check your stack JSON