Loading story…
Jenkins released security updates in Jenkins 2.576 and LTS 2.568.2 to address multiple vulnerabilities, including CVE-2026-70426, a critical Remoting deserialization filter bypass that can let agent processes, code running on agents, or users with Agent/Connect permission bypass JEP-200 protections and potentially achieve code execution on the controller. The advisory also covers core flaws that can enable arbitrary file write leading to controller code execution, an impersonation issue tied to case-insensitive usernames and groups, and unsafe project naming strategy object instantiation. Jenkins said the Remoting issue affects Jenkins 2.575 and earlier and LTS 2.568.1 and earlier, and was fixed in Remoting 3385.vf1123fb_515da_.
The same advisory disclosed serious plugin vulnerabilities, led by CVE-2026-70431 and CVE-2026-70432 in the Multijob Plugin, where Groovy scripting and a CSRF weakness can allow users with Item/Create or Item/Configure permissions to execute arbitrary code in the Jenkins controller JVM. Additional plugin issues include credential enumeration and capture paths, unauthorized workspace file access, a timing side channel in Webhook Secret Credentials Provider Plugin, stored XSS, misuse of system-scoped credentials, and an XXE flaw in Ivy Report Plugin. Jenkins also warned that several plugin vulnerabilities had no fix available at publication time, affecting plugins including AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, and XML Job to Job DSL.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
A CVE record was newly received for CVE-2026-70432, a CSRF vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier. The flaw stems from a form validation endpoint not requiring POST requests and can lead to arbitrary code execution in the Jenkins controller JVM.
A CVE record was newly received for CVE-2026-70431, covering an arbitrary code execution flaw in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier caused by Groovy scripting features not integrating with Script Security Plugin. The issue allows attackers with Item/Create or Item/Configure permission to execute code in the Jenkins controller JVM.
A CVE record was published for CVE-2026-70426, a critical Jenkins Remoting deserialization filter bypass affecting Remoting 3384.v60d89463d9e0 and earlier, as included in Jenkins 2.575 and earlier and LTS 2.568.1 and earlier. Jenkins lists fixes in Jenkins 2.576, Jenkins LTS 2.568.2, and Remoting 3385.vf1123fb_515da_.
Jenkins published a security advisory announcing fixes in Jenkins 2.576, Jenkins LTS 2.568.2, and several plugins including External Workspace Manager, HCL AppScan, Multijob, SCM-Manager, and Webhook Secret Credentials Provider. The advisory also disclosed multiple unresolved plugin vulnerabilities for which no fixes were available at publication time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourceacn.gov.it
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jenkins released security updates for multiple plugins, including **Active Directory**, **LDAP**, **AppSpider**, **Bitbucket OAuth**, **Credentials Binding**, **Email Extension**, **GitHub Integration**, **Job Import**, **Multijob**, and **Pipeline: Groovy Libraries**. The most severe issues affect the **LDAP** and **Active Directory** plugins, which could follow LDAP referrals to attacker-controlled RMI URLs and trigger deserialization on the Jenkins controller, creating a potential path to remote code execution under certain conditions. The advisory also addressed a range of additional plugin vulnerabilities, including arbitrary file read, arbitrary file write that could enable code execution, phishing through an open redirect, CSRF-triggered actions, credential ID enumeration, and SSRF-like outbound connections. Jenkins separately disclosed a **stored XSS** flaw in the `buildgraph-view` plugin that remained unresolved at publication time, leaving users without an available fix for that issue.
Jun 29, 2026
Jenkins published a security advisory covering multiple vulnerabilities in widely used plugins, with fixes released for affected versions. The disclosed issues span **missing permission checks**, **unsafe deserialization**, **stored cross-site scripting**, and an **open redirect**, affecting plugins including **Script Security**, **Credentials Binding**, **Matrix Authorization Strategy**, **GitHub Branch Source**, **GitHub**, **HTML Publisher**, and **Microsoft Entra ID**. The most serious issue is an **arbitrary file write** flaw that can lead to **remote code execution**, while other bugs could let attackers abuse low-privilege access such as `Overall/Read`, `Item/Configure`, or the ability to supply credentials to a job. Jenkins said the advisory includes severity ratings, attribution, and patched plugin versions, and urged administrators to update impacted plugins to the fixed releases.
Jun 29, 2026
Jenkins has released fixes in **Jenkins 2.568** and **Jenkins LTS 2.555.3** for multiple vulnerabilities affecting the automation server, including a high-impact unsafe deserialization flaw tracked as **`CVE-2026-53435`**. According to the disclosure, attackers with **Overall/Read** permission and additional access such as a valid user account or the ability to post `config.xml` data could trigger deserialization of Jenkins core or plugin types, potentially leading to **user impersonation, arbitrary HTTP requests, possible Script Console code execution, and arbitrary file reads** from the Jenkins controller. The issues affect **Jenkins 2.567 and earlier** and **Jenkins LTS 2.555.2 and earlier**. The advisory also addresses several additional weaknesses, including **open redirect** bugs in the login flow, a **missing permission check** in HTTP endpoints, an **unsafe redirect** in the "Delegate to servlet container" security realm, a **stored XSS** issue through offline cause descriptions, and exposure of **plaintext secrets** through `config.xml` handling. Organizations running self-managed Jenkins instances should prioritize upgrading to the fixed releases and review controller exposure, user permissions, and configuration handling paths that could allow low-privileged users to reach sensitive functionality.
Jun 29, 2026