CVE-2026-84650

Katalog CVE

CVSS 8.8 · High EPSS 0,47%

Kerentanan Deserialization of Untrusted Data pada jenkins. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

Rincian

Terbit di NVD

2 September 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4032 advisory vendor