CVE-2026-117622 Jenkins Project CVE debrief

Who should care

Defenders responsible for Jenkins deployments should assess exposure and apply patches or mitigations to prevent exploitation. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation. The vulnerability allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a XSS vulnerability exploitable by attackers in control of agent processes.

Why it matters

CVE-2026-117622 is a cross-site scripting (XSS) vulnerability in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, allowing agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a XSS vulnerability exploitable by attackers in control of agent processes. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation.

• Defenders need to verify exposure and apply patches or mitigations to prevent exploitation
• Attackers in control of agent processes can exploit this vulnerability to conduct XSS attacks

Technical summary

The vulnerability exists in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, allowing agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a XSS vulnerability exploitable by attackers in control of agent processes. The vulnerability can be triggered by attackers in control of agent processes, and defenders should assess exposure and apply patches or mitigations to prevent exploitation. The affected product context is Jenkins 2.587 and earlier, LTS 2.580.1 and earlier.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation.

Recommended defensive actions

• Verify Jenkins version and check if it's within the affected range
• Apply patches or mitigations to prevent exploitation
• Monitor agent processes for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability exists in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier. Defenders should verify exposure and apply patches or mitigations to prevent exploitation. The vulnerability allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a XSS vulnerability exploitable by attackers in control of agent processes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.