CVE-2026-92136 Jenkins Project CVE debrief

Who should care

Jenkins administrators and users with Item/Configure permission should assess exposure and take action to mitigate the vulnerability. Defenders should prioritize verifying exposure in Jenkins environments and applying updates to the OWASP Dependency-Check Plugin to prevent XSS attacks. The vulnerability allows attackers to inject malicious scripts into the Jenkins UI, and it is exploitable by attackers with Item/Configure permission.

Why it matters

Defenders should prioritize verifying exposure in Jenkins environments and applying updates to the OWASP Dependency-Check Plugin to prevent XSS attacks.

• Attackers could inject malicious scripts into the Jenkins UI
• Exploitation requires Item/Configure permission
• Successful exploitation could lead to XSS attacks on Jenkins users

Technical summary

The Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. The vulnerability allows attackers to inject malicious scripts into the Jenkins UI. Defenders should prioritize verifying exposure in Jenkins environments and applying updates to the OWASP Dependency-Check Plugin to prevent XSS attacks. The source detail is limited, and defenders should verify exposure in Jenkins environments and apply updates to the OWASP Dependency-Check Plugin.

Defensive priority

Defenders should prioritize verifying exposure in Jenkins environments and applying updates to the OWASP Dependency-Check Plugin.

Recommended defensive actions

• Verify Jenkins OWASP Dependency-Check Plugin version and update to a fixed version if necessary
• Restrict Item/Configure permission to trusted users
• Monitor Jenkins UI for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the stored cross-site scripting (XSS) vulnerability in Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier. The vulnerability allows attackers to inject malicious scripts into the Jenkins UI, and it is exploitable by attackers with Item/Configure permission. The source detail is limited, and defenders should verify exposure in Jenkins environments and apply updates to the OWASP Dependency-Check Plugin. The CVE record was published on 2026-09-16T14:17:15.587Z and has not been modified

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.