Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute duri

Summary

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.

Remediation

1. Inventory every Jenkins Jenkins deployment, including staging.
2. Upgrade Jenkins Jenkins to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4125