CVE-2026-84650

8.8 highEPSS 0.5%

High (8.8) in jenkins jenkins. EPSS 0.5% chance of exploitation in the next 30 days.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWEs: CWE-502, CWE-566
Published: 2026-09-02
Modified: 2026-09-11
Record from: the NVD, synced 2026-10-19

Affected

jenkins:jenkins

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4032

Check your stack JSON