CVE-2026-70426
Quick assessment
Affected
Jenkins Project Jenkins
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Jenkins是Jenkins组织开源的一款持续集成与持续交付的自动化服务器。 Jenkins 2.575及之前版本和Jenkins LTS 2.568.1及之前版本存在反序列化注入漏洞，该漏洞源于JEP-200类过滤器未应用于通过Remoting反序列化实现中的回退路径解析的类，可能导致代理进程、代理上运行的代码以及具有Agent/Connect权限的攻击者绕过JEP-200反序列化过滤器。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1210 · Exploitation of Remote ServicesAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Jenkins Project | Jenkins | 2.576< * |
unaffected |
2.568.2< 2.568.* |
unaffected | ||
| Jenkins Project | Remoting | 3385.vf1123fb_515da_< * |
unaffected |
3355.3357.v931d3c992987< 3355.* |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-70426
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Jenkins 反序列化注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Jenkins是Jenkins组织开源的一款持续集成与持续交付的自动化服务器。 Jenkins 2.575及之前版本和Jenkins LTS 2.568.1及之前版本存在反序列化注入漏洞，该漏洞源于JEP-200类过滤器未应用于通过Remoting反序列化实现中的回退路径解析的类，可能导致代理进程、代理上运行的代码以及具有Agent/Connect权限的攻击者绕过JEP-200反序列化过滤器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Jenkins Project | Jenkins | 2.576 ~ * | - |
|
| Jenkins Project | Remoting | 3385.vf1123fb_515da_ ~ * | - |
|
II. Public POCs for CVE-2026-70426
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
default-local-qwen3.6
· 10367 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-70426
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-70426 (1)
Same Patch Batch · Jenkins Project · 2026-08-05 · 23 CVEs total
| CVE-2026-70438 | Jenkins Parameterized Remote Trigger 安全漏洞 | |
| CVE-2026-70448 | Jenkins Ivy Report 安全漏洞 | |
| CVE-2026-70447 | Jenkins AWS CodeBuild 安全漏洞 | |
| CVE-2026-70446 | Jenkins CodeSonar 安全漏洞 | |
| CVE-2026-70444 | Jenkins Violation Comments to GitLab 安全漏洞 | |
| CVE-2026-70445 | Jenkins Sauce OnDemand 安全漏洞 | |
| CVE-2026-70443 | Jenkins Horreum 安全漏洞 | |
| CVE-2026-70442 | Jenkins Google Chat Notification 安全漏洞 | |
| CVE-2026-70440 | Jenkins Qualys Container Scanning Connector 安全漏洞 | |
| CVE-2026-70441 | Jenkins Summary Display 安全漏洞 | |
| CVE-2026-70439 | Jenkins XML Job to Job DSL 安全漏洞 | |
| CVE-2026-70427 | Jenkins 后置链接漏洞 | |
| CVE-2026-70437 | Jenkins Webhook Secret Credentials Provider 安全漏洞 | |
| CVE-2026-70436 | Jenkins External Workspace Manager 安全漏洞 | |
| CVE-2026-70434 | Jenkins SCM-Manager Plugin 安全漏洞 | |
| CVE-2026-70435 | Jenkins SCM-Manager Plugin 安全漏洞 | |
| CVE-2026-70433 | Jenkins HCL AppScan 安全漏洞 | |
| CVE-2026-70432 | Jenkins Multijob 跨站请求伪造漏洞 | |
| CVE-2026-70431 | Jenkins Multijob 代码注入漏洞 | |
| CVE-2026-70430 | Jenkins 安全漏洞 |
Showing top 20 of 23 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-70426
No comments yet