CVE-2026-84654

Medium

Description

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify public static fields of the configuration objects those forms are bound to, resulting in changes that apply globally to the Jenkins instance.

SeverityMedium

CVSS5.4

Exploit probability—

Product

Jenkins

PublishedSep 2, 2026

First seenSep 2, 2026

Weakness typeCWE-472CWE-472

How to fix

Vendor advisories

jenkins.io/security/advisory/2026-09-02/#SECURITY-3926

Affected products

Product	Affected versions	Fixed in
Jenkins Project Jenkins	No range specified	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.