CVE-2025-64140

—

CVSS 3.1

8.8 high

EPSS

<1%p45

Published

Oct 29, 2025 (Oct 29, 2025)

Modified

Jun 17, 2026

Description

Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.

Vendors: jenkins
Products: azure cli
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.