CVE-2026-84646

—

CVSS 3.1

4.3 medium

EPSS

<1%p15

Published

Sep 2, 2026 (13d ago)

Modified

Sep 11, 2026

Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

Vendors: jenkins
Products: jenkins
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.