Jenkins Security Advisory: Critical Deserialization Bypass, RCE, Privilege Escalation CVEs

The following is a summary of the key vulnerability information based on the provided web page screenshot: --- Jenkins Security Advisory 2026-08-05 Vulnerability Overview This security advisory covers vulnerabilities in multiple Jenkins components, including core and plugins. The main issues include serialization bypass, arbitrary file creation, path traversal, privilege escalation, and arbitrary code execution. --- Vulnerability Details 1. Agent-to-controller deserialization filter bypass Vulnerability ID: SECURITY-3911 / CVE-2026-70426 Severity: Critical Description: Jenkins uses the Remoting library for communication between the controller and agents. In Jenkins versions 2.575 and earlier, the JEP-200 class filter was not applied to classes resolved via the fallback path, allowing attackers to bypass the JEP-200 deserialization filter and execute code on the controller. Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. Remediation: Upgrade to Jenkins 2.576 or LTS 2.568.2. --- 2. Link following vulnerability allows arbitrary file creation Vulnerability ID: SECURITY-3930 / CVE-2026-70427 Severity: High Description: Jenkins versions 2.575 and earlier failed to handle symbolic links correctly, allowing attackers to create arbitrary files on the controller's file system via and archive files. Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. Remediation: Upgrade to Jenkins 2.576 or LTS 2.568.2. --- 3. Path traversal vulnerability in file parameters Vulnerability ID: SECURITY-3927 / CVE-2026-70428 Severity: High Description: Jenkins versions 2.575 and earlier failed to properly identify path traversal in file parameters, allowing attackers with Item/Configure and Item/Build permissions to write arbitrary files on the controller's file system. Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. Remediation: Upgrade to Jenkins 2.576 or LTS 2.568.2. --- 4. Improper handling of case sensitivity allows privilege escalation Vulnerability ID: SECURITY-3924 / CVE-2026-70429 Severity: High Description: Jenkins versions 2.575 and earlier did not properly handle case sensitivity when processing usernames and group names, allowing attackers to create new users or groups that matched existing users or groups in a case-insensitive manner. Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. Remediation: Upgrade to Jenkins 2.576 or LTS 2.568.2. --- 5. Users with Overall/Manage permission can instantiate any types related to configuration Vulnerability ID: SECURITY-3916 / CVE-2026-70430 Severity: Low Description: Jenkins versions 2.575 and earlier did not restrict the types of objects that could be instantiated, allowing attackers with Overall/Manage permissions to instantiate arbitrary configuration-related objects. Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. Remediation: Upgrade to Jenkins 2.576 or LTS 2.568.2. --- 6. Arbitrary code execution vulnerability in Multijob Plugin Vulnerability ID: SECURITY-3823 (1) / CVE-2026-70431 Severity: High Description: Multijob Plugin versions 669.v9d96a_d9c71b_0 and earlier are not integrated with the Script Security Plugin, allowing attackers to execute arbitrary code. Affected Versions: Multijob Plugin 669.v9d96a_d9c71b_0 and earlier. Remediation: Upgrade to Multijob Plugin 677.v7ffc23d6a_4c2. --- 7. CSRF vulnerability in Multijob Plugin allows arbitrary code execution Vulnerability ID: SECURITY-3823 (2) / CVE-2026-70432 Severity: High Description: Multijob Plugin versions 669.v9d96a_d9c71b_0 and earlier did not require POST requests for form validation endpoints, resulting in a Cross-Site Request Forgery (CSRF) vulnerability. Affected Versions: Multijob Plugin 669.v9d96a_d9c71b_0 and earlier. Remediation: Upgrade to Multijob Plugin 677.v7ffc23d6a_4c2. --- 8. Missing permission checks in HCL AppScan Plugin allow enumerating credentials IDs Vulnerability ID: SECURITY-3771 / CVE-2026-70433 Severity: Medium Description: HCL AppScan Plugin versions 1.8.3 and earlier failed to enforce permission checks, allowing attackers to enumerate credential IDs. Affected Versions: HCL AppScan Plugin 1.8.3 and earlier. Remediation: Upgrade to HCL AppScan Plugin 1.8.4. --- 9. CSRF vulnerability and missing permission checks in SCM-Manager Plugin Vulnerability ID: SECURITY-3888 / CVE-2026-70434 (CSRF), CVE-2026-70435 (permission check) Severity: Medium Description: SCM-Manager Plugin versions 1.11.1 and earlier failed to enforce permission checks, allowing attackers to connect using attacker-specified HTTP URLs and capture credentials. Affected Versions: SCM-Manager Plugin 1.11.1 and earlier. Remediation: Upgrade to SCM-Manager Plugin 1.12.1. --- 10. Missing permission check in External Workspace Manager Plugin allows reading workspace files Vulnerability ID: SECURITY-3907 / CVE-2026-70436 Severity: Medium Description: External Workspace Manager Plugin versions 1.4.1 and earlier failed to enforce perm

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: Critical Deserialization Bypass, RCE, Privilege Escalation CVEs