Is CVE-2026-92128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92128 being exploited in the wild.

How severe is CVE-2026-92128?

High severity, with a CVSS score of 7.5, published 16 September 2026.

Which products and versions are affected?

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier.

Is there a fix for CVE-2026-92128?

A patch was published on 2026-09-16: Fixed in Script Security Plugin 1422.v06869826dd9b_ and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92128 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92128?

Check whether you run Jenkins Script Security Plugin or Jenkins Script Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92128: Jenkins Script Security Plugin arbitrary JAR loading via double download

CVE-2026-92128 · Severity: high · CVSS 7.5 · Published 2026-09-16

Jenkins Script Security Plugin is a component that enables secure execution of user-provided scripts within Jenkins by applying a sandbox. A flaw in versions 1415.v9a_f9b_3a_c253d and earlier causes the plugin to download and verify a JAR file once, then download it again without re-verifying before loading it. An attacker able to define classpath entries could exploit this race condition to substitute a malicious JAR between the two downloads, leading to arbitrary code execution within the Jenkins server itself.

Technologies: Jenkins Script Security Plugin, Jenkins Script Security. Vendors: Jenkins.

Quick answers

Is CVE-2026-92128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92128 being exploited in the wild.
How severe is CVE-2026-92128?: High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier.
Is there a fix for CVE-2026-92128?: A patch was published on 2026-09-16: Fixed in Script Security Plugin 1422.v06869826dd9b_ and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92128 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92128?: Check whether you run Jenkins Script Security Plugin or Jenkins Script Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a race condition and authorization bypass in the Jenkins Script Security Plugin's classpath handling. The plugin downloads a JAR file specified by URL, validates the download, but then performs a second download of the same JAR without re-validating it before loading the classpath entries. An attacker with permission to define classpath entries can intercept or manipulate the second download to substitute malicious code. The attack requires network-level manipulation (man-in-the-middle) or control over the JAR source, and execution occurs in the Jenkins controller JVM context with full privileges. Jenkins has patched this in version 1422.v06869826dd9b_ and later by implementing proper validation for all JAR loads.

Affected products

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier

Timeline

2026-09-16: disclosed: CVE-2026-92128 disclosed in Jenkins Security Advisory 2026-09-16
2026-09-16: patched: Fixed in Script Security Plugin 1422.v06869826dd9b_ and later

References

https://www.jenkins.io/security/advisory/2026-09-16/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.