Quick answers
- Is CVE-2026-84650 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84650 being exploited in the wild.
- How severe is CVE-2026-84650?
- High severity, with a CVSS score of 8.8, published 2 September 2026.
- Which products and versions are affected?
- Jenkins 2.579 and earlier, LTS 2.568.2 and earlier.
- Is there a fix for CVE-2026-84650?
- A patch was published on 2026-09-02: Jenkins 2.580, LTS 2.568.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84650 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-84650?
- Check whether you run Jenkins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a deserialization flaw in Jenkins' use of XStream for loading and saving configuration and build data. Transient fields, which normally should not be serialized, can be included during deserialization of user-submitted config.xml documents. Attackers able to submit configuration updates (typically users with Overall/Read or configuration update permissions) can craft XML payloads that specify values for transient fields. The impact depends on how those fields are subsequently used; in certain cases, this can lead to remote code execution via the Script Console. Jenkins 2.580 and LTS 2.568.3 fix this by preventing transient fields from being included during deserialization.
Affected products
- Jenkins Jenkins 2.579 and earlier, LTS 2.568.2 and earlier
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Jenkins 2.580, LTS 2.568.3