Jenkins vulnerabilities and CVEs

Known vulnerabilities affecting Jenkins, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

8 vulnerabilities tracked.

• 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name,… CVE-2026-117616 28 Oct 2026
• 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by… CVE-2026-117614 28 Oct 2026
• 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the resolves-to… CVE-2026-117612 28 Oct 2026
• 8.1 In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the… CVE-2026-117618 28 Oct 2026
• 8.1 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its… CVE-2026-117617 28 Oct 2026
• 6.5 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing… CVE-2026-117615 28 Oct 2026
• 5.4 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers… CVE-2026-117613 28 Oct 2026
• 4.3 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for… CVE-2026-117626 28 Oct 2026