Vulnerability · Published Sep 16, 2026 · Assigned by jenkins
CVE-2026-92128
High 7.5
In plain English
A high-severity security flaw in Jenkins Script Security Plugin from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 78.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jenkins Project | Jenkins Script Security Plugin | 0 – through 1415.v9a_f9b_3a_c253d |
Weakness: CWE-494 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- Jenkins Security Advisory 2026-09-16 vendor-advisory