CVE-2026-84650
Received Received - Intake

Jenkins Deserialization Flaw Allows Configuration Manipulation

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Jenkins Project

Description
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84650
EUVD
EUVD-2026-70116

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jenkins jenkins to 2.580 (exc)
jenkins jenkins_lts to 2.569 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

In Jenkins versions 2.579 and earlier, including LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization. This means attackers who can submit configuration updates may set values for transient fields that will be deserialized, with the impact depending on how those fields are used in the system.

Impact Analysis

Attackers could manipulate transient fields during deserialization to alter application behavior, potentially leading to unauthorized access, data leaks, or system compromise depending on how those fields are utilized in Jenkins configurations.

Mitigation Strategies

Upgrade Jenkins to version 2.580 or later for the weekly release, or to LTS 2.568.3 or later for the long-term support release to address the deserialization issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84650. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart