Security updatesJenkins Security Team

Jenkins September advisory fixes core deserialisation: review build-platform permissions too

Jenkins disclosed security issues in core and several plugins. A core deserialisation flaw may allow access to an inadequately protected Script Console. Core fixes are listed in 2.580 and LTS 2.568.3; plugins still need individual checks.

Anti-Ransomware · Compiled with SI agent assistanceOfficial security advisory date:Checked 2026.10.26
Original scenario illustration of a build platform work queue, Jenkins plugin inventory and permission checks
Illustration · Source ↗ · About this image ↗

Source Facts

Jenkins issued a security advisory on 2 September covering its core and several plugins. CVE-2026-84645 is rated high severity and involves user-submitted XML configuration and object deserialisation. Certain combinations could allow an attacker to access an inadequately protected Script Console.

The advisory says the core issue affects Jenkins 2.579 and earlier and LTS 2.568.2 and earlier, with restrictions added in 2.580 and LTS 2.568.3. Other core and plugin issues appear on the same page; updating the core does not resolve the entire plugin list.

Next Steps for Businesses / Editorial Observations

Build platforms often access code and deployment credentials. Inventory controllers and plugins separately, and review who can submit or modify job configurations.

Next steps you can take

  • Check Jenkins core and every installed plugin, reviewing the fix or handling status for each item in this advisory.
  • After updating, test representative jobs and agent connections, and review configuration-change permissions and access to deployment credentials.

Original sources

Jenkins Security Advisory 2026-09-02

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxOriginal scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NETIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42