CVE-2026-84645

Jenkins weekly releases 2.579 and earlier and LTS releases 2.568.2 and earlier allow remote code execution because user-submitted `config.xml` documents can contain nested field values of object types that are marked as storing their configuration in independent top-level configuration files, such as the global configuration and jobs; these objects can then handle HTTP requests through the Stapler request framework. An attacker who can submit such a configuration file, per the CVSS vector a network-based attacker with low (i.e., authenticated, low-privilege) access and no user interaction, gains code execution on the Jenkins controller. All controllers running an affected weekly or LTS release are in scope, particularly where the config.xml endpoint is reachable by lower-privileged users. There is no sign of active exploitation so far: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.7% probability of exploitation within 30 days.

What to do: Upgrade every controller above the vulnerable ranges — a weekly release newer than 2.579 and an LTS release newer than 2.568.2. As an interim mitigation, restrict which users can submit/upload config.xml (limit configuration write access to trusted/administrative accounts) and review controllers for signs of compromise, since exploitation yields code execution. Monitor for suspicious POSTs to config.xml endpoints on controllers that cannot yet be upgraded.