Jenkins fixes 15 flaws, including remote code execution bugs

The Jenkins project has issued a security advisory on 28 October 2026 announcing fixes for 15 vulnerabilities across Jenkins core and related components. The flaws span remote code execution, file read/write, path traversal, and account-takeover scenarios, with 13 of the issues reported in part by Anthropic’s OSS program and two through the Jenkins Bug Bounty Programme sponsored by the European Commission.

The advisory classifies 13 of the issues as High and two as Medium, with several flaws permitting remote code execution on the Jenkins controller and some enabling unauthenticated or low-privilege attackers to escalate access or impersonate administrators. The report notes that there is currently no confirmed exploitation at scale, but cautions that attackers with Overall/Read or Configure permissions could leverage these bugs in practice, depending on the specific flaw.

Key CVEs addressed include CVE-2026-117612, CVE-2026-117613, CVE-2026-117614, CVE-2026-117615, CVE-2026-117616, CVE-2026-117617, CVE-2026-117618, CVE-2026-117619, CVE-2026-117620, and related entries, all fixed in Jenkins version 2.588 or in LTS 2.580.2 (with some fixes backported to 2.580.2). The advisory highlights a high-severity RCE cluster with an 8.8 CVSS 3.1 score, alongside a setup-wizard race condition scoring 8.1 and two Medium issues at 4.3.

Affected products are Jenkins weekly 2.587 and earlier and Jenkins LTS 2.580.1 and earlier. Practitioners are urged to upgrade to Jenkins 2.588 or LTS 2.580.2 and to apply the updated security checks, noting that if problems arise, Java system properties can disable new checks as a mitigation.