CVE-2026-117614Not scored
Jenkins Project Jenkins vulnerability
Jenkins Project · Jenkins
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 29 Oct.
- Jenkins fixes 15 flaws, including remote code execution bugsSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.