# Jenkins vulnerabilities Source: https://junglewise.ai/threats/technologies/jenkins Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/jenkins.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 42 vulnerabilities in Jenkins: 0 in the last 7 days and 27 in the last 90 days, 4 of them critical and 3 exploited in the wild. The most recent, CVE-2026-117626, was published on 28 October 2026. 14 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 14 - Last 90 days: 27 - All time: 42 (4 critical, 3 exploited in the wild) ## About Jenkins Jenkins is an open-source automation server used for continuous integration and delivery. ## Latest Jenkins vulnerabilities - [CVE-2026-117626: Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly) (info, published 28 Oct 2026) - [CVE-2026-117625: Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2) (info, published 28 Oct 2026) - [CVE-2026-117624: Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not) (info, published 28 Oct 2026) - [CVE-2026-117623: Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not) (info, published 28 Oct 2026) - [CVE-2026-117622: Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents) (info, published 28 Oct 2026) - [CVE-2026-117621: Jenkins workspace browser XSS in agent URL computation](https://junglewise.ai/threats/cve-2026-117621-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-computes-on) (info, published 28 Oct 2026) - [CVE-2026-117620: Jenkins Manage Old Data injection allows password override](https://junglewise.ai/threats/cve-2026-117620-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows) (info, published 28 Oct 2026) - [CVE-2026-117619: Jenkins "remember me" cookie obtained via API token authentication](https://junglewise.ai/threats/cve-2026-117619-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows) (info, published 28 Oct 2026) - [CVE-2026-117617: Jenkins symbolic link in artifact extraction path traversal](https://junglewise.ai/threats/cve-2026-117617-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-checks-for) (info, published 28 Oct 2026) - [CVE-2026-117616: Jenkins path traversal in agent name loading](https://junglewise.ai/threats/cve-2026-117616-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-provides-an) (info, published 28 Oct 2026) - [CVE-2026-117615: Jenkins arbitrary file read via symlink following during item rename](https://junglewise.ai/threats/cve-2026-117615-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-follows) (info, published 28 Oct 2026) - [CVE-2026-117614: Jenkins agent launch command approval bypass](https://junglewise.ai/threats/cve-2026-117614-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-converts-the) (info, published 28 Oct 2026) - [CVE-2026-117613: Jenkins collection element type validation bypass](https://junglewise.ai/threats/cve-2026-117613-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not) (info, published 28 Oct 2026) - [CVE-2026-117612: Jenkins XStream deserialization filter bypass via resolves-to attribute](https://junglewise.ai/threats/cve-2026-117612-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not-apply) (info, published 28 Oct 2026) - [CVE-2026-84657: Jenkins build CLI command authorization bypass via -s flag](https://junglewise.ai/threats/cve-2026-84657-jenkins-build-cli-command-authorization-bypass-via-s-flag) (medium, CVSS 4.2, published 2 Sep 2026) - [CVE-2026-84656: Jenkins missing permission check on build parameters](https://junglewise.ai/threats/cve-2026-84656-jenkins-missing-permission-check-on-build-parameters) (medium, CVSS 4.3, published 2 Sep 2026) - [CVE-2026-84655: Jenkins REST API JSON key injection](https://junglewise.ai/threats/cve-2026-84655-jenkins-rest-api-json-key-injection) (medium, CVSS 4.3, published 2 Sep 2026) - [CVE-2026-84654: Stapler form data binding allows setting public static fields in Jenkins](https://junglewise.ai/threats/cve-2026-84654-stapler-form-data-binding-allows-setting-public-static-fields-in) (medium, CVSS 5.4, published 2 Sep 2026) - [CVE-2026-84653: Jenkins Appearance configuration permission bypass](https://junglewise.ai/threats/cve-2026-84653-jenkins-appearance-configuration-permission-bypass) (low, CVSS 3.5, published 2 Sep 2026) - [CVE-2026-84652: Jenkins session fixation via remember me cookie](https://junglewise.ai/threats/cve-2026-84652-jenkins-session-fixation-via-remember-me-cookie) (high, CVSS 7.3, published 2 Sep 2026) - [CVE-2026-84651: Jenkins agent configuration privilege escalation](https://junglewise.ai/threats/cve-2026-84651-jenkins-agent-configuration-privilege-escalation) (medium, CVSS 6.3, published 2 Sep 2026) - [CVE-2026-84650: Jenkins transient field deserialization bypass](https://junglewise.ai/threats/cve-2026-84650-jenkins-transient-field-deserialization-bypass) (high, CVSS 8.8, published 2 Sep 2026) - [CVE-2026-84649: Stapler CSRF token exposure in dynamically generated JavaScript](https://junglewise.ai/threats/cve-2026-84649-stapler-csrf-token-exposure-in-dynamically-generated-javascript) (high, CVSS 8.8, published 2 Sep 2026) - [CVE-2026-84648: Jenkins system log viewer stored XSS in metadata](https://junglewise.ai/threats/cve-2026-84648-jenkins-system-log-viewer-stored-xss-in-metadata) (high, CVSS 8.8, published 2 Sep 2026) - [CVE-2026-84647: Stapler type instantiation bypass in Jenkins](https://junglewise.ai/threats/cve-2026-84647-stapler-type-instantiation-bypass-in-jenkins) (high, CVSS 8.8, published 2 Sep 2026) ## Most severe Jenkins vulnerabilities - [CVE-2015-5317: Jenkins discloses project names via fingerprints](https://junglewise.ai/threats/cve-2015-5317-jenkins-user-interface-ui-information-disclosure-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 13 May 2022) - [CVE-2017-1000353: Deserialization of Untrusted Data in Jenkins](https://junglewise.ai/threats/cve-2017-1000353-jenkins-remote-code-execution-via-cli-java-deserialization) (critical, exploited in the wild, CVSS 3, published 13 May 2022) - [CVE-2018-1000861: Deserialization of Untrusted Data in Jenkins](https://junglewise.ai/threats/cve-2018-1000861-jenkins-stapler-web-framework-deserialization-of-untrusted-data) (critical, exploited in the wild, CVSS 3, published 13 May 2022) - [CVE-2016-9299: Jenkins remoting module Java deserialization RCE via LDAP query](https://junglewise.ai/threats/cve-2016-9299-jenkins-remoting-module-java-deserialization-rce-via-ldap-query) (critical, CVSS 9.8, published 12 Jan 2017) - [CVE-2026-53435: Jenkins arbitrary type deserialization in config.xml processing](https://junglewise.ai/threats/cve-2026-53435-jenkins-arbitrary-type-deserialization-in-config-xml-processing) (high, CVSS 8.8, published 10 Jun 2026) - [CVE-2026-84645: Jenkins deserialization RCE in config.xml handling](https://junglewise.ai/threats/cve-2026-84645-jenkins-deserialization-rce-in-config-xml-handling) (high, CVSS 8.8, published 2 Sep 2026) - [CVE-2026-84648: Jenkins system log viewer stored XSS in metadata](https://junglewise.ai/threats/cve-2026-84648-jenkins-system-log-viewer-stored-xss-in-metadata) (high, CVSS 8.8, published 2 Sep 2026) - [CVE-2026-84647: Stapler type instantiation bypass in Jenkins](https://junglewise.ai/threats/cve-2026-84647-stapler-type-instantiation-bypass-in-jenkins) (high, CVSS 8.8, published 2 Sep 2026) - [CVE-2026-84650: Jenkins transient field deserialization bypass](https://junglewise.ai/threats/cve-2026-84650-jenkins-transient-field-deserialization-bypass) (high, CVSS 8.8, published 2 Sep 2026) - [CVE-2026-84649: Stapler CSRF token exposure in dynamically generated JavaScript](https://junglewise.ai/threats/cve-2026-84649-stapler-csrf-token-exposure-in-dynamically-generated-javascript) (high, CVSS 8.8, published 2 Sep 2026) ## Vulnerabilities per week 14 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 13 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 14 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Jenkins technologies - [Jenkins Script Security](https://junglewise.ai/threats/technologies/script-security): 11 vulnerabilities - [Jenkins Script Security Plugin](https://junglewise.ai/threats/technologies/script-security-plugin): 11 vulnerabilities - [Jenkins Mcp Server](https://junglewise.ai/threats/technologies/mcp-server): 4 vulnerabilities - [Jenkins LTS](https://junglewise.ai/threats/technologies/jenkins-lts): 3 vulnerabilities - [Jenkins Pipeline: Groovy Libraries Plugin](https://junglewise.ai/threats/technologies/pipeline-groovy-libraries-plugin): 3 vulnerabilities - [Jenkins Publish To Bitbucket](https://junglewise.ai/threats/technologies/publish-to-bitbucket): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Jenkins vulnerabilities", https://junglewise.ai/threats/technologies/jenkins, 9 November 2026.