Is CVE-2026-92127 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92127 being exploited in the wild.

How severe is CVE-2026-92127?

High severity, with a CVSS score of 8, published 16 September 2026.

Which products and versions are affected?

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier.

Is there a fix for CVE-2026-92127?

A patch was published on 2026-09-16: Version 1422.v06869826dd9b_ released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92127 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92127?

Check whether you run Jenkins Script Security Plugin or Jenkins Script Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92127: Jenkins Script Security Plugin classpath approval bypass

CVE-2026-92127 · Severity: high · CVSS 8 · Published 2026-09-16

Jenkins Script Security Plugin is a component that controls which code operations are allowed to run safely within Jenkins. The plugin automatically approves classpath entries when administrators copy items or update configurations via API/CLI, allowing attackers to define malicious classpath entries that execute arbitrary code on the Jenkins server, potentially compromising the entire CI/CD infrastructure and any systems it can access.

Technologies: Jenkins Script Security Plugin, Jenkins Script Security. Vendors: Jenkins.

Quick answers

Is CVE-2026-92127 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92127 being exploited in the wild.
How severe is CVE-2026-92127?: High severity, with a CVSS score of 8, published 16 September 2026.
Which products and versions are affected?: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier.
Is there a fix for CVE-2026-92127?: A patch was published on 2026-09-16: Version 1422.v06869826dd9b_ released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92127 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92127?: Check whether you run Jenkins Script Security Plugin or Jenkins Script Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a privilege escalation and sandbox bypass vulnerability in Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier (CVE-2026-92127, SECURITY-3929). The plugin fails to validate classpath entries in item configurations when those configurations are copied or updated via REST API or CLI by users with Overall/Administer permission. An attacker with permissions to define classpath entries can inject arbitrary code that executes in the Jenkins controller JVM context. The vulnerability requires initial access (ability to define or modify item configurations through copy/API/CLI operations), but no user interaction beyond that. Jenkins has released version 1422.v06869826dd9b_ which properly validates classpath entries to remediate this issue.

Affected products

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier

Timeline

2026-09-16: disclosed
2026-09-16: patched: Version 1422.v06869826dd9b_ released

References

https://www.jenkins.io/security/advisory/2026-09-16/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.