CVE-2026-92128 Jenkins Project CVE debrief

Who should care

Jenkins administrators and users who have the Script Security Plugin installed should assess their exposure and verify their version of the plugin. Additionally, security teams and vulnerability management teams should review the vulnerability and plan for remediation. Platform operators and asset owners may also need to review and update their systems to prevent exploitation.

Why it matters

CVE-2026-92128 is a high-severity vulnerability in the Jenkins Script Security Plugin that allows attackers to execute arbitrary code in the context of the Jenkins controller JVM. Defenders should prioritize verifying and upgrading to a non-vulnerable version of the plugin, restrict access to the Jenkins controller JVM, and monitor logs for suspicious activity.

• Attackers may be able to execute arbitrary code in the context of the Jenkins controller JVM.
• Defenders need to verify and upgrade to a non-vulnerable version of the Jenkins Script Security Plugin.
• Defenders should restrict access to the Jenkins controller JVM to prevent attackers from defining classpath entries.

Technical summary

The Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second. This allows attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM. The vulnerability has a CVSS score of 7.5 and is considered high-severity. Defenders should prioritize verifying and upgrading to a non-vulnerable version of the plugin, restrict access to the Jenkins controller JVM, and monitor logs for suspicious activity.

Defensive priority

Defenders should prioritize verifying and upgrading to a non-vulnerable version of the Jenkins Script Security Plugin.

Recommended defensive actions

• Verify the version of the Jenkins Script Security Plugin and upgrade to a non-vulnerable version if necessary.
• Restrict access to the Jenkins controller JVM to prevent attackers from defining classpath entries.
• Monitor Jenkins controller JVM logs for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier is affected. Defenders should verify the plugin version and review official advisories for more information. Evidence is limited to publicly available sources and may not reflect the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.