CVE-2026-84650
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to speci…
Published: 2026-09-02 · CVSS: 8.8 · CVSS 3.1
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7