CVE-2026-117613Not scored
Jenkins Project Jenkins vulnerability
Jenkins Project · Jenkins
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 29 Oct.
- Jenkins fixes 15 flaws, including remote code execution bugsSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.