Remote code execution vulnerability affecting Jenkins
A vulnerability affecting Jenkins would allow a malicious actor to remotely execute code on affected systems.
Description
Technical context and vulnerability details
Jenkins is an open source continuous integration (CI) and continuous deployment (CD) tool. It is used to automate repetitive tasks related to software development, including building, testing, and deploying applications. This product is affected by a vulnerability labeled CVE-2026-84645, resulting from the ability for certain configuration objects, normally stored in separate configuration files, to be embedded as nested field values in user-submitted config.xml files. Exploitation of this vulnerability would allow a malicious actor to submit malicious HTTP requests via Stapler and execute code remotely on the affected system. It is classified high with a severity score of 8.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- Jenkins version 2.579 and earlier;
- Jenkins LTS version 2.568.2 and earlier;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Jenkins to version 2.580 or later for stable branch;
- Update Jenkins to version 2.568.3 or later for LTS branch;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.