Vulnerability-Lookup

WID-SEC-W-2026-2665

Vulnerability from csaf_certbund - Published: 2026-08-05 22:00 - Updated: 2026-08-05 22:00

Summary

Jenkins Plugins: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren sowie Cross-Site-Scripting- (XSS) oder Server-Side-Request-Forgery- (SSRF) Angriffe durchzuführen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-70426

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70427

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70428

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70429

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70430

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70431

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70432

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70433

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70434

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70435

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70436

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70437

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Jenkins Jenkins weekly <2.576 Jenkins / Jenkins		weekly <2.576
Jenkins Jenkins LTS <2.568.2 Jenkins / Jenkins		LTS <2.568.2
Jenkins Jenkins External Workspace Manager <1.4.2 Jenkins / Jenkins		External Workspace Manager <1.4.2
Jenkins Jenkins HCL AppScan <1.8.4 Jenkins / Jenkins		HCL AppScan <1.8.4
Jenkins Jenkins Multijob <677.v7ffc23d6a_4c2 Jenkins / Jenkins		Multijob <677.v7ffc23d6a_4c2
Jenkins Jenkins SCM-Manager <1.12.1 Jenkins / Jenkins		SCM-Manager <1.12.1
Jenkins Jenkins Webhook Secret Credentials Provider <32.v09c9b_522f0a_8 Jenkins / Jenkins		Webhook Secret Credentials Provider <32.v09c9b_522f0a_8

CVE-2026-70438

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

CVE-2026-70439

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

CVE-2026-70440

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

CVE-2026-70441

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

CVE-2026-70442

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

CVE-2026-70443

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

CVE-2026-70444

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

CVE-2026-70445

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

CVE-2026-70446

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

CVE-2026-70447

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

CVE-2026-70448

Affected products

Last affected 10 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Ivy Report <=1.2 Jenkins / Jenkins		Ivy Report <=1.2
Jenkins Jenkins Parameterized Remote Trigger <=3.2.2 Jenkins / Jenkins		Parameterized Remote Trigger <=3.2.2
Jenkins Jenkins Qualys Container Scanning Connector <=1.8.0.5 Jenkins / Jenkins		Qualys Container Scanning Connector <=1.8.0.5
Jenkins Jenkins Sauce OnDemand <=2.2.0 Jenkins / Jenkins		Sauce OnDemand <=2.2.0
Jenkins Jenkins Violation Comments to GitLab <=2.62.0 Jenkins / Jenkins		Violation Comments to GitLab <=2.62.0
Jenkins Jenkins XML Job to Job DS <=0.1.13 Jenkins / Jenkins		XML Job to Job DS <=0.1.13
Jenkins Jenkins AWS CodeBuild <=0.59 Jenkins / Jenkins		AWS CodeBuild <=0.59
Jenkins Jenkins CodeSonar <=3.6.0 Jenkins / Jenkins		CodeSonar <=3.6.0
Jenkins Jenkins Google Chat Notification <=166.ve6b_de280f2e8 Jenkins / Jenkins		Google Chat Notification <=166.ve6b_de280f2e8
Jenkins Jenkins Horreum <=0.16.162.v33b_4a_a_b_5f828 Jenkins / Jenkins		Horreum <=0.16.162.v33b_4a_a_b_5f828

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.jenkins.io/security/advisory/2026-08-05/	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterst\u00fctzung bei Softwareentwicklungen aller Art.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuf\u00fchren, Berechtigungen zu erweitern, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren sowie Cross-Site-Scripting- (XSS) oder Server-Side-Request-Forgery- (SSRF) Angriffe durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2665 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2665.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2665 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2665"
      },
      {
        "category": "external",
        "summary": "Jenkins Security Advisory vom 2026-08-05",
        "url": "https://www.jenkins.io/security/advisory/2026-08-05/"
      }
    ],
    "source_lang": "en-US",
    "title": "Jenkins Plugins: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-05T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-06T09:41:12.985+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2665",
      "initial_release_date": "2026-08-05T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-08-05T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "weekly \u003c2.576",
                "product": {
                  "name": "Jenkins Jenkins weekly \u003c2.576",
                  "product_id": "T057567"
                }
              },
              {
                "category": "product_version",
                "name": "weekly 2.576",
                "product": {
                  "name": "Jenkins Jenkins weekly 2.576",
                  "product_id": "T057567-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:weekly__2.576"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "LTS \u003c2.568.2",
                "product": {
                  "name": "Jenkins Jenkins LTS \u003c2.568.2",
                  "product_id": "T057568"
                }
              },
              {
                "category": "product_version",
                "name": "LTS 2.568.2",
                "product": {
                  "name": "Jenkins Jenkins LTS 2.568.2",
                  "product_id": "T057568-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:lts__2.568.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "External Workspace Manager \u003c1.4.2",
                "product": {
                  "name": "Jenkins Jenkins External Workspace Manager \u003c1.4.2",
                  "product_id": "T057569"
                }
              },
              {
                "category": "product_version",
                "name": "External Workspace Manager 1.4.2",
                "product": {
                  "name": "Jenkins Jenkins External Workspace Manager 1.4.2",
                  "product_id": "T057569-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:external_workspace_manager__1.4.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "HCL AppScan \u003c1.8.4",
                "product": {
                  "name": "Jenkins Jenkins HCL AppScan \u003c1.8.4",
                  "product_id": "T057570"
                }
              },
              {
                "category": "product_version",
                "name": "HCL AppScan 1.8.4",
                "product": {
                  "name": "Jenkins Jenkins HCL AppScan 1.8.4",
                  "product_id": "T057570-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:hcl_appscan__1.8.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Multijob \u003c677.v7ffc23d6a_4c2",
                "product": {
                  "name": "Jenkins Jenkins Multijob \u003c677.v7ffc23d6a_4c2",
                  "product_id": "T057571"
                }
              },
              {
                "category": "product_version",
                "name": "Multijob 677.v7ffc23d6a_4c2",
                "product": {
                  "name": "Jenkins Jenkins Multijob 677.v7ffc23d6a_4c2",
                  "product_id": "T057571-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:multijob__677.v7ffc23d6a_4c2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "SCM-Manager \u003c1.12.1",
                "product": {
                  "name": "Jenkins Jenkins SCM-Manager \u003c1.12.1",
                  "product_id": "T057572"
                }
              },
              {
                "category": "product_version",
                "name": "SCM-Manager 1.12.1",
                "product": {
                  "name": "Jenkins Jenkins SCM-Manager 1.12.1",
                  "product_id": "T057572-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:scm-manager__1.12.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Webhook Secret Credentials Provider \u003c32.v09c9b_522f0a_8",
                "product": {
                  "name": "Jenkins Jenkins Webhook Secret Credentials Provider \u003c32.v09c9b_522f0a_8",
                  "product_id": "T057573"
                }
              },
              {
                "category": "product_version",
                "name": "Webhook Secret Credentials Provider 32.v09c9b_522f0a_8",
                "product": {
                  "name": "Jenkins Jenkins Webhook Secret Credentials Provider 32.v09c9b_522f0a_8",
                  "product_id": "T057573-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:webhook_secret_credentials_provider__32.v09c9b_522f0a_8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "AWS CodeBuild \u003c=0.59",
                "product": {
                  "name": "Jenkins Jenkins AWS CodeBuild \u003c=0.59",
                  "product_id": "T057585"
                }
              },
              {
                "category": "product_version_range",
                "name": "AWS CodeBuild \u003c=0.59",
                "product": {
                  "name": "Jenkins Jenkins AWS CodeBuild \u003c=0.59",
                  "product_id": "T057585-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "CodeSonar \u003c=3.6.0",
                "product": {
                  "name": "Jenkins Jenkins CodeSonar \u003c=3.6.0",
                  "product_id": "T057586"
                }
              },
              {
                "category": "product_version_range",
                "name": "CodeSonar \u003c=3.6.0",
                "product": {
                  "name": "Jenkins Jenkins CodeSonar \u003c=3.6.0",
                  "product_id": "T057586-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "Google Chat Notification \u003c=166.ve6b_de280f2e8",
                "product": {
                  "name": "Jenkins Jenkins Google Chat Notification \u003c=166.ve6b_de280f2e8",
                  "product_id": "T057587"
                }
              },
              {
                "category": "product_version_range",
                "name": "Google Chat Notification \u003c=166.ve6b_de280f2e8",
                "product": {
                  "name": "Jenkins Jenkins Google Chat Notification \u003c=166.ve6b_de280f2e8",
                  "product_id": "T057587-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "Horreum \u003c=0.16.162.v33b_4a_a_b_5f828",
                "product": {
                  "name": "Jenkins Jenkins Horreum \u003c=0.16.162.v33b_4a_a_b_5f828",
                  "product_id": "T057588"
                }
              },
              {
                "category": "product_version_range",
                "name": "Horreum \u003c=0.16.162.v33b_4a_a_b_5f828",
                "product": {
                  "name": "Jenkins Jenkins Horreum \u003c=0.16.162.v33b_4a_a_b_5f828",
                  "product_id": "T057588-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "Ivy Report \u003c=1.2",
                "product": {
                  "name": "Jenkins Jenkins Ivy Report \u003c=1.2",
                  "product_id": "T057589"
                }
              },
              {
                "category": "product_version_range",
                "name": "Ivy Report \u003c=1.2",
                "product": {
                  "name": "Jenkins Jenkins Ivy Report \u003c=1.2",
                  "product_id": "T057589-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "Parameterized Remote Trigger \u003c=3.2.2",
                "product": {
                  "name": "Jenkins Jenkins Parameterized Remote Trigger \u003c=3.2.2",
                  "product_id": "T057590"
                }
              },
              {
                "category": "product_version_range",
                "name": "Parameterized Remote Trigger \u003c=3.2.2",
                "product": {
                  "name": "Jenkins Jenkins Parameterized Remote Trigger \u003c=3.2.2",
                  "product_id": "T057590-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "Qualys Container Scanning Connector \u003c=1.8.0.5",
                "product": {
                  "name": "Jenkins Jenkins Qualys Container Scanning Connector \u003c=1.8.0.5",
                  "product_id": "T057591"
                }
              },
              {
                "category": "product_version_range",
                "name": "Qualys Container Scanning Connector \u003c=1.8.0.5",
                "product": {
                  "name": "Jenkins Jenkins Qualys Container Scanning Connector \u003c=1.8.0.5",
                  "product_id": "T057591-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "Sauce OnDemand \u003c=2.2.0",
                "product": {
                  "name": "Jenkins Jenkins Sauce OnDemand \u003c=2.2.0",
                  "product_id": "T057592"
                }
              },
              {
                "category": "product_version_range",
                "name": "Sauce OnDemand \u003c=2.2.0",
                "product": {
                  "name": "Jenkins Jenkins Sauce OnDemand \u003c=2.2.0",
                  "product_id": "T057592-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "Violation Comments to GitLab \u003c=2.62.0",
                "product": {
                  "name": "Jenkins Jenkins Violation Comments to GitLab \u003c=2.62.0",
                  "product_id": "T057593"
                }
              },
              {
                "category": "product_version_range",
                "name": "Violation Comments to GitLab \u003c=2.62.0",
                "product": {
                  "name": "Jenkins Jenkins Violation Comments to GitLab \u003c=2.62.0",
                  "product_id": "T057593-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "XML Job to Job DS \u003c=0.1.13",
                "product": {
                  "name": "Jenkins Jenkins XML Job to Job DS \u003c=0.1.13",
                  "product_id": "T057594"
                }
              },
              {
                "category": "product_version_range",
                "name": "XML Job to Job DS \u003c=0.1.13",
                "product": {
                  "name": "Jenkins Jenkins XML Job to Job DS \u003c=0.1.13",
                  "product_id": "T057594-fixed"
                }
              }
            ],
            "category": "product_name",
            "name": "Jenkins"
          }
        ],
        "category": "vendor",
        "name": "Jenkins"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-70426",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70426"
    },
    {
      "cve": "CVE-2026-70427",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70427"
    },
    {
      "cve": "CVE-2026-70428",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70428"
    },
    {
      "cve": "CVE-2026-70429",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70429"
    },
    {
      "cve": "CVE-2026-70430",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70430"
    },
    {
      "cve": "CVE-2026-70431",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70431"
    },
    {
      "cve": "CVE-2026-70432",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70432"
    },
    {
      "cve": "CVE-2026-70433",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70433"
    },
    {
      "cve": "CVE-2026-70434",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70434"
    },
    {
      "cve": "CVE-2026-70435",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70435"
    },
    {
      "cve": "CVE-2026-70436",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70436"
    },
    {
      "cve": "CVE-2026-70437",
      "product_status": {
        "known_affected": [
          "T057567",
          "T057568",
          "T057569",
          "T057570",
          "T057571",
          "T057572",
          "T057573"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70437"
    },
    {
      "cve": "CVE-2026-70438",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70438"
    },
    {
      "cve": "CVE-2026-70439",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70439"
    },
    {
      "cve": "CVE-2026-70440",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70440"
    },
    {
      "cve": "CVE-2026-70441",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70441"
    },
    {
      "cve": "CVE-2026-70442",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70442"
    },
    {
      "cve": "CVE-2026-70443",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70443"
    },
    {
      "cve": "CVE-2026-70444",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70444"
    },
    {
      "cve": "CVE-2026-70445",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70445"
    },
    {
      "cve": "CVE-2026-70446",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70446"
    },
    {
      "cve": "CVE-2026-70447",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70447"
    },
    {
      "cve": "CVE-2026-70448",
      "product_status": {
        "last_affected": [
          "T057589",
          "T057590",
          "T057591",
          "T057592",
          "T057593",
          "T057594",
          "T057585",
          "T057586",
          "T057587",
          "T057588"
        ]
      },
      "release_date": "2026-08-05T22:00:00.000+00:00",
      "title": "CVE-2026-70448"
    }
  ]
}

CVE-2026-70426 (GCVE-0-2026-70426)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:40 – Updated: 2026-08-06 03:55

Summary

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-05 00:00 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2026-08-…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Jenkins Project	Jenkins	Unaffected: 2.576 , < * (maven) Unaffected: 2.568.2 , < 2.568.* (maven)
Jenkins Project	Remoting	Unaffected: 3385.vf1123fb_515da_ , < * (maven) Unaffected: 3355.3357.v931d3c992987 , < 3355.* (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70426",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-502",
                "description": "CWE-502 Deserialization of Untrusted Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T03:55:46.082Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.576",
              "versionType": "maven"
            },
            {
              "lessThan": "2.568.*",
              "status": "unaffected",
              "version": "2.568.2",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Remoting",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3385.vf1123fb_515da_",
              "versionType": "maven"
            },
            {
              "lessThan": "3355.*",
              "status": "unaffected",
              "version": "3355.3357.v931d3c992987",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:40:27.071Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-08-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-70426",
    "datePublished": "2026-08-05T17:40:27.071Z",
    "dateReserved": "2026-08-04T14:13:20.602Z",
    "dateUpdated": "2026-08-06T03:55:46.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-70427 (GCVE-0-2026-70427)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:40 – Updated: 2026-08-05 18:25

Summary

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-05 18:25 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2026-08-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins	Unaffected: 2.576 , < * (maven) Unaffected: 2.568.2 , < 2.568.* (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70427",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T18:25:33.385273Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-59",
                "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T18:25:36.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.576",
              "versionType": "maven"
            },
            {
              "lessThan": "2.568.*",
              "status": "unaffected",
              "version": "2.568.2",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:40:27.698Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-08-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-70427",
    "datePublished": "2026-08-05T17:40:27.698Z",
    "dateReserved": "2026-08-04T14:13:20.602Z",
    "dateUpdated": "2026-08-05T18:25:36.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-70428 (GCVE-0-2026-70428)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:40 – Updated: 2026-08-05 18:22

Summary

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-05 18:21 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2026-08-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins	Unaffected: 2.576 , < * (maven) Unaffected: 2.568.2 , < 2.568.* (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70428",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T18:21:58.692809Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T18:22:01.212Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.576",
              "versionType": "maven"
            },
            {
              "lessThan": "2.568.*",
              "status": "unaffected",
              "version": "2.568.2",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:40:28.349Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-08-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-70428",
    "datePublished": "2026-08-05T17:40:28.349Z",
    "dateReserved": "2026-08-04T14:13:20.602Z",
    "dateUpdated": "2026-08-05T18:22:01.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-70429 (GCVE-0-2026-70429)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:40 – Updated: 2026-08-06 15:08

Summary

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 15:08 UTC

CWE

CWE-178 - Improper Handling of Case Sensitivity

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2026-08-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins	Unaffected: 2.576 , < * (maven) Unaffected: 2.568.2 , < 2.568.* (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T15:08:02.563080Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-178",
                "description": "CWE-178 Improper Handling of Case Sensitivity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T15:08:29.147Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.576",
              "versionType": "maven"
            },
            {
              "lessThan": "2.568.*",
              "status": "unaffected",
              "version": "2.568.2",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:40:29.055Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-08-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-70429",
    "datePublished": "2026-08-05T17:40:29.055Z",
    "dateReserved": "2026-08-04T14:13:20.602Z",
    "dateUpdated": "2026-08-06T15:08:29.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-70430 (GCVE-0-2026-70430)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:40 – Updated: 2026-08-06 15:05

Summary

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators.

Severity

2.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 15:04 UTC

CWE

CWE-284 - Improper Access Control

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2026-08-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins	Unaffected: 2.576 , < * (maven) Unaffected: 2.568.2 , < 2.568.* (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 2.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70430",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T15:04:31.909460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T15:05:21.518Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.576",
              "versionType": "maven"
            },
            {
              "lessThan": "2.568.*",
              "status": "unaffected",
              "version": "2.568.2",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:40:29.707Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-08-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3916"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-70430",
    "datePublished": "2026-08-05T17:40:29.707Z",
    "dateReserved": "2026-08-04T14:13:20.602Z",
    "dateUpdated": "2026-08-06T15:05:21.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-70431 (GCVE-0-2026-70431)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:40 – Updated: 2026-08-06 03:55

Summary

Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-05 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2026-08-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Multijob Plugin	Affected: 0 , ≤ 669.v9d96a_d9c71b_0 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70431",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T03:55:47.215Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jenkins Multijob Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "669.v9d96a_d9c71b_0",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:40:30.435Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-08-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3823%20(1)"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-70431",
    "datePublished": "2026-08-05T17:40:30.435Z",
    "dateReserved": "2026-08-04T14:13:20.602Z",
    "dateUpdated": "2026-08-06T03:55:47.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-70432 (GCVE-0-2026-70432)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:40 – Updated: 2026-08-05 18:27

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-05 18:26 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2026-08-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Multijob Plugin	Affected: 0 , ≤ 669.v9d96a_d9c71b_0 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70432",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T18:26:34.514413Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T18:27:00.547Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jenkins Multijob Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "669.v9d96a_d9c71b_0",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:40:31.152Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-08-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3823%20(2)"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-70432",
    "datePublished": "2026-08-05T17:40:31.152Z",
    "dateReserved": "2026-08-04T14:13:20.602Z",
    "dateUpdated": "2026-08-05T18:27:00.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-70433 (GCVE-0-2026-70433)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:40 – Updated: 2026-08-06 15:01

Summary

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 15:01 UTC

CWE

CWE-862 - Missing Authorization

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2026-08-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins HCL AppScan Plugin	Affected: 0 , ≤ 1.8.3 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70433",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T15:01:20.951542Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T15:01:30.026Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jenkins HCL AppScan Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "1.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:40:31.802Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-08-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3771"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-70433",
    "datePublished": "2026-08-05T17:40:31.802Z",
    "dateReserved": "2026-08-04T14:13:20.602Z",
    "dateUpdated": "2026-08-06T15:01:30.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-70434 (GCVE-0-2026-70434)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:40 – Updated: 2026-08-06 14:59

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 14:59 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2026-08-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins SCM-Manager Plugin	Affected: 0 , ≤ 1.11.1 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70434",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T14:59:25.524773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T14:59:33.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jenkins SCM-Manager Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "1.11.1",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:40:32.523Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-08-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3888"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-70434",
    "datePublished": "2026-08-05T17:40:32.523Z",
    "dateReserved": "2026-08-04T14:13:20.602Z",
    "dateUpdated": "2026-08-06T14:59:33.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-70435 (GCVE-0-2026-70435)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:40 – Updated: 2026-08-06 14:57

Summary

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 14:57 UTC

CWE

CWE-862 - Missing Authorization

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2026-08-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins SCM-Manager Plugin	Affected: 0 , ≤ 1.11.1 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70435",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T14:57:38.590358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T14:57:47.318Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jenkins SCM-Manager Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "1.11.1",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:40:33.247Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-08-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3888"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-70435",
    "datePublished": "2026-08-05T17:40:33.247Z",
    "dateReserved": "2026-08-04T14:13:20.602Z",
    "dateUpdated": "2026-08-06T14:57:47.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

WID-SEC-W-2026-2665

CVE-2026-70426 (GCVE-0-2026-70426)

CVE-2026-70427 (GCVE-0-2026-70427)

CVE-2026-70428 (GCVE-0-2026-70428)

CVE-2026-70429 (GCVE-0-2026-70429)

CVE-2026-70430 (GCVE-0-2026-70430)

CVE-2026-70431 (GCVE-0-2026-70431)

CVE-2026-70432 (GCVE-0-2026-70432)

CVE-2026-70433 (GCVE-0-2026-70433)

CVE-2026-70434 (GCVE-0-2026-70434)

CVE-2026-70435 (GCVE-0-2026-70435)

Tags

Sightings

Nomenclature