# CVE-2026-92128: Jenkins Script Security Plugin arbitrary JAR loading via double download

Source: https://junglewise.ai/threats/cve-2026-92128-jenkins-script-security-plugin-arbitrary-jar-loading-via-double  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92128 · Severity: high · CVSS 7.5 · Published 2026-09-16

Jenkins Script Security Plugin is a component that enables secure execution of user-provided scripts within Jenkins by applying a sandbox. A flaw in versions 1415.v9a_f9b_3a_c253d and earlier causes the plugin to download and verify a JAR file once, then download it again without re-verifying before loading it. An attacker able to define classpath entries could exploit this race condition to substitute a malicious JAR between the two downloads, leading to arbitrary code execution within the Jenkins server itself.

Technologies: [Jenkins Script Security Plugin](https://junglewise.ai/threats/technologies/script-security-plugin), [Jenkins Script Security](https://junglewise.ai/threats/technologies/script-security). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins).

## Quick answers

**Is CVE-2026-92128 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92128 being exploited in the wild.

**How severe is CVE-2026-92128?** High severity, with a CVSS score of 7.5, published 16 September 2026.

**Which products and versions are affected?** Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier.

**Is there a fix for CVE-2026-92128?** A patch was published on 2026-09-16: Fixed in Script Security Plugin 1422.v06869826dd9b_ and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92128 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92128?** Check whether you run Jenkins Script Security Plugin or Jenkins Script Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a race condition and authorization bypass in the Jenkins Script Security Plugin's classpath handling. The plugin downloads a JAR file specified by URL, validates the download, but then performs a second download of the same JAR without re-validating it before loading the classpath entries. An attacker with permission to define classpath entries can intercept or manipulate the second download to substitute malicious code. The attack requires network-level manipulation (man-in-the-middle) or control over the JAR source, and execution occurs in the Jenkins controller JVM context with full privileges. Jenkins has patched this in version 1422.v06869826dd9b_ and later by implementing proper validation for all JAR loads.

## Affected products

- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier

## Timeline

- 2026-09-16: disclosed: CVE-2026-92128 disclosed in Jenkins Security Advisory 2026-09-16
- 2026-09-16: patched: Fixed in Script Security Plugin 1422.v06869826dd9b_ and later

## References

- [https://www.jenkins.io/security/advisory/2026-09-16/](https://www.jenkins.io/security/advisory/2026-09-16/)

## Related threats

- [Jenkins Script Security Plugin sandbox bypass with dynamic methods](https://junglewise.ai/threats/cve-2026-92129-jenkins-script-security-plugin-sandbox-bypass-with-dynamic)
- [Jenkins Script Security Plugin classpath approval bypass](https://junglewise.ai/threats/cve-2026-92127-jenkins-script-security-plugin-classpath-approval-bypass)
- [Jenkins Script Security Plugin sandbox bypass via @Builder annotation](https://junglewise.ai/threats/cve-2026-92126-jenkins-script-security-plugin-sandbox-bypass-via-builder)
- [Jenkins Script Security Plugin sandbox bypass via @GroovyASTTransformationClass](https://junglewise.ai/threats/cve-2026-92125-jenkins-script-security-plugin-sandbox-bypass-via)
- [Jenkins Script Security Plugin sandbox bypass in collection casting](https://junglewise.ai/threats/cve-2026-92124-jenkins-script-security-plugin-sandbox-bypass-in-collection)