The Jenkins project has shipped a security release fixing 31 issues under 33 CVE identifiers across the core server, 17 plugins and its update-site generator, and the headline bug lets an attacker reach the Script Console, the built-in Groovy shell that amounts to remote code execution on the controller. The Jenkins security team's advisory of 2 September was relayed by Hong Kong's CERT in a bulletin a day later.
Jenkins weekly 2.579 and earlier and LTS 2.568.2 and earlier are affected. The fixes are in weekly 2.580 and LTS 2.568.3. The Jenkins team rates 14 of the issues High and 17 Medium; it publishes severity labels rather than numeric CVSS scores.
A config file that talks back to the web server
The most serious core flaw is CVE-2026-84645. Jenkins stores configuration with XStream serialization and routes HTTP requests with the Stapler framework. In affected versions, objects of types meant to live in their own top-level config files can be smuggled in as nested values inside a user-submitted config.xml, and those objects then handle HTTP requests via Stapler. A crafted combination lands the attacker in an improperly protected Script Console. The fix stops such types from being deserialized as nested field values. It arrives a month after another deserialization bypass, that one in the agent-to-controller channel.
Three more High-rated core bugs sit on the session and browser side. CVE-2026-84649 embeds the user's CSRF token in dynamically generated JavaScript that a page on a sibling subdomain can load and read; anyone who cannot update immediately should disable the Resource Root URL feature or move it to a different domain. CVE-2026-84652 is a session fixation flaw in the "remember me" cookie flow, again exploitable from a sibling subdomain. CVE-2026-84648 is stored XSS in the system log viewer, exploitable by whoever controls an agent process. Two further High-rated core bugs, CVE-2026-84647 and CVE-2026-84650, let form submissions and configuration updates instantiate or set object fields they should not.
One annotation, eight plugins
A pattern runs through the plugin half of the advisory. Stapler instantiates objects through constructors marked @DataBoundConstructor, and eight plugins had put that annotation on constructors never meant to be invoked by users, letting anyone who could submit certain forms trigger privileged behavior. The worst cases are the SAML plugin (CVE-2026-84668, High), where an attacker can overwrite the identity-provider metadata file and then authenticate as any user, and the File Parameter plugin (CVE-2026-84671, High), where uploaded files can be written to arbitrary paths on the controller and lead to remote code execution. The same mistake let attackers redirect ThinBackup backups and include arbitrary controller files in them (CVE-2026-84667, High), point the LDAP and GitLab plugins at attacker-chosen servers, the latter using administrators' stored API tokens, inject JavaScript through a custom SVG icon in Customizable Header (CVE-2026-84673, High), and switch off the global sandbox enforcement setting in Script Security (CVE-2026-84659, Medium).
Elsewhere, the Performance plugin deserialized cached reports without class restrictions, giving anyone with Item/Configure permission code execution on the controller (CVE-2026-84670, High). The Microsoft Entra ID plugin granted group permissions by display name as well as object ID (CVE-2026-84672, High); display names are not unique, so a tenant member could create a matching group and inherit a privileged Jenkins grant. Administrators who relied on display-name grants may lose access after upgrading; Jenkins warns the system property that restores the old behavior is insecure.
Update to 2.580 or LTS 2.568.3, then the plugins
Update the core first, then each affected plugin to the versions listed in the advisory. One issue has no fix at publication: the Parameterized Remote Trigger plugin stores tokens unencrypted in job config.xml files (CVE-2026-84676, Medium).
For a build server that holds cloud credentials, signing keys and deploy access to everything downstream, a Script Console reachable through a crafted configuration file is about as bad as a Jenkins bug gets. This is a same-day upgrade.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.