CVE-2026-92123 Jenkins Project CVE debrief

Who should care

Jenkins administrators and users who define and run sandboxed scripts should assess their exposure and take necessary actions to prevent exploitation. This includes verifying the version of the Jenkins Script Security Plugin, restricting permissions for users who can define and run sandboxed scripts, and monitoring the Jenkins controller JVM for suspicious activity. Additionally, security teams and platform operators should be aware of the potential impact

Why it matters

CVE-2026-92123 is a high-severity vulnerability in Jenkins Script Security Plugin that allows attackers to bypass sandbox protection and execute arbitrary code. Defenders should prioritize verifying exposure and applying patches.

• Potential for arbitrary code execution in the context of the Jenkins controller JVM
• Bypassing of sandbox protection by attackers with permission to define and run sandboxed scripts
• Possible disruption of Jenkins services

Technical summary

The Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver, allowing attackers with permission to define and run sandboxed scripts to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. This vulnerability has a high CVSS score of 8.8, indicating a high severity. The plugin's failure to intercept operations on null receivers enables attackers to bypass sandbox protection, potentially leading to code execution in the Jenkins controller JVM.

Defensive priority

Defenders should prioritize verifying exposure and applying patches due to the high CVSS score of 8.8 and the potential for arbitrary code execution in the context of the Jenkins controller JVM.

Recommended defensive actions

• Verify the version of Jenkins Script Security Plugin and upgrade to a patched version if necessary
• Review and restrict permissions for users who can define and run sandboxed scripts
• Monitor Jenkins controller JVM for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier. The plugin does not intercept operations performed on a null receiver, allowing attackers to bypass the sandbox protection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.