Loading story…
Jenkins released security updates for multiple vulnerabilities in its CI/CD automation platform, including six high-severity flaws involving remote code execution, security-restriction bypass, tampering, and spoofing. Jenkins core versions 2.579 and earlier, and LTS versions 2.568.2 and earlier, are affected; fixed releases are 2.580 and 2.568.3, respectively.
The advisory also identifies vulnerabilities in update-center2 and numerous plugins, including Allure, GitLab, LDAP, SAML, and Script Security. The Canadian Centre for Cyber Security, Italy's ACN/CSIRT, and bjCSIRT urged administrators to review the Jenkins security bulletin, update core installations and affected plugins, and prioritize exposed or internet-accessible Jenkins servers.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-877 covering the Jenkins vulnerabilities and advised users and administrators to review the Jenkins security advisory and apply available updates.
FreeBSD published a security update for its Jenkins and Jenkins LTS packages addressing 13 vulnerabilities, CVE-2026-84645 through CVE-2026-84657. The associated Tenable check reported no known exploits and assesses affected hosts through local FreeBSD package inventory checks.
Jenkins Project reported vulnerabilities affecting Jenkins core, update-center2, and numerous plugins. Affected core releases include Jenkins 2.579 and earlier and LTS 2.568.2 and earlier; fixed core versions are 2.580 and 2.568.3, while six issues were rated high severity and included remote code execution, security-restriction bypass, tampering, and spoofing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
csirt.bj
Open sourceacn.gov.it
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jenkins released security updates in **Jenkins 2.576** and **LTS 2.568.2** to address multiple vulnerabilities, including **CVE-2026-70426**, a critical Remoting deserialization filter bypass that can let agent processes, code running on agents, or users with `Agent/Connect` permission bypass JEP-200 protections and potentially achieve code execution on the controller. The advisory also covers core flaws that can enable arbitrary file write leading to controller code execution, an impersonation issue tied to case-insensitive usernames and groups, and unsafe project naming strategy object instantiation. Jenkins said the Remoting issue affects Jenkins 2.575 and earlier and LTS 2.568.1 and earlier, and was fixed in Remoting `3385.vf1123fb_515da_`. The same advisory disclosed serious plugin vulnerabilities, led by **CVE-2026-70431** and **CVE-2026-70432** in the **Multijob Plugin**, where Groovy scripting and a CSRF weakness can allow users with `Item/Create` or `Item/Configure` permissions to execute arbitrary code in the Jenkins controller JVM. Additional plugin issues include credential enumeration and capture paths, unauthorized workspace file access, a timing side channel in Webhook Secret Credentials Provider Plugin, stored XSS, misuse of system-scoped credentials, and an XXE flaw in Ivy Report Plugin. Jenkins also warned that several plugin vulnerabilities had **no fix available** at publication time, affecting plugins including AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, and XML Job to Job DSL.
Aug 6, 2026
Jenkins published a security advisory covering multiple vulnerabilities in widely used plugins, with fixes released for affected versions. The disclosed issues span **missing permission checks**, **unsafe deserialization**, **stored cross-site scripting**, and an **open redirect**, affecting plugins including **Script Security**, **Credentials Binding**, **Matrix Authorization Strategy**, **GitHub Branch Source**, **GitHub**, **HTML Publisher**, and **Microsoft Entra ID**. The most serious issue is an **arbitrary file write** flaw that can lead to **remote code execution**, while other bugs could let attackers abuse low-privilege access such as `Overall/Read`, `Item/Configure`, or the ability to supply credentials to a job. Jenkins said the advisory includes severity ratings, attribution, and patched plugin versions, and urged administrators to update impacted plugins to the fixed releases.
Jun 29, 2026
Jenkins, a widely used open-source automation server, has released critical security updates to address multiple high-severity vulnerabilities that could expose CI/CD pipelines to significant risks. The most severe flaw, tracked as CVE-2025-67635, affects Jenkins versions 2.540 and earlier (including LTS 2.528.2 and earlier) and allows unauthenticated attackers to trigger denial-of-service (DoS) attacks via the HTTP-based command-line interface. This vulnerability arises from improper connection handling, where corrupted HTTP CLI streams are not properly closed, enabling attackers to exhaust server resources and render Jenkins instances unresponsive. Organizations relying on Jenkins are urged to upgrade to version 2.541 or LTS 2.528.3 to mitigate this risk. In addition to the DoS vulnerability, another high-severity issue, CVE-2025-67641, was identified in the Jenkins Coverage Plugin. This flaw allows attackers with "Item/Configure" permissions to exploit coverage reports for stored cross-site scripting (XSS) attacks by submitting malicious JavaScript via the REST API. If an administrator views a compromised report, the script executes, potentially leading to session hijacking. Both vulnerabilities have been addressed in the latest Jenkins security updates, and immediate patching is recommended to protect against exploitation.
Jun 29, 2026