Jenkins vulnerabilities and fixes
Exploited and high-severity Jenkins vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 8.8CVE-2026-117624Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing tRCEFix availableJenkins Jenkins
1 min read - 8.1CVE-2026-117619Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtaFix availableJenkins Jenkins
1 min read - 8.8CVE-2026-117620Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature Fix availableJenkins Jenkins
1 min read - 8.1CVE-2026-117617Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directorFix availableJenkins Jenkins
1 min read - 8.1CVE-2026-117618In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard hFix availableJenkins Jenkins
1 min read - 8.8CVE-2026-117616Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackersRCEFix availableJenkins Jenkins
1 min read - 7.2CVE-2026-117614Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command AFix availableJenkins Jenkins
1 min read - 8.8CVE-2026-117612Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute duriRCEFix availableJenkins Jenkins
1 min read