CVE-2026-84659

4.3 mediumEPSS 0.3%

Medium (4.3) in jenkins script security. EPSS 0.3% chance of exploitation in the next 30 days.

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-09-02
Modified: 2026-09-22
Record from: the NVD, synced 2026-10-19

Affected

jenkins:script_security

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3986

Check your stack JSON