CVE-2026-70427 – Jenkins
“A critical Remoting weakness can bypass a core Jenkins security boundary, while two file-handling flaws expose the controller to arbitrary writes.”
Jenkins updates address three vulnerabilities affecting Remoting and controller file handling. CVE-2026-70426 has a CVSS score of 9.0, Critical severity, and allows agent processes, code running on agents, or users with Agent/Connect permission to bypass the JEP-200 deserialization class filter. CVE-2026-70427 and CVE-2026-70428 each have a CVSS score of 4.3, Medium severity.
The Medium-severity flaws can allow files to be written to arbitrary locations on the Jenkins controller through crafted archives or file parameter path traversal. Updated Jenkins and Remoting releases address these weaknesses.
Key Details
- Affected Product
- Jenkins Jenkins
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-59