CVE-2026-84645

Katalog CVE

CVSS 8.8 · High EPSS 0,79%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada jenkins. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.

Rincian

Terbit di NVD

2 September 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3972 advisory vendor