Quick answers
- Is CVE-2026-92123 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92123 being exploited in the wild.
- How severe is CVE-2026-92123?
- High severity, with a CVSS score of 8.8, published 16 September 2026.
- Which products and versions are affected?
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier.
- Is there a fix for CVE-2026-92123?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-92123 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-92123?
- Check whether you run Jenkins Script Security Plugin or Jenkins Script Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a sandbox bypass in the Script Security Plugin's Groovy sandbox. The root cause is missing interception of operations on null receivers—method calls, property accesses, attribute accesses, and array accesses performed on null values are not checked. An attacker with pipeline or script definition permissions can craft a sandboxed script that performs these unchecked operations on null to bypass sandbox restrictions and execute arbitrary code in the Jenkins JVM. No authentication is required beyond permission to define and run scripts. The fix is available in version 1422.v06869826dd9b_ or later, which intercepts all operations on null receivers.
Affected products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Timeline
- 2026-09-16: disclosed