CVE-2026-57281 affects Jenkins Script Security Plugin versions 1402.v94c9ce464861 and earlier. The plugin does not reject Groovy AST transformation annotations carrying an extensions member, which enables attackers who can run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath. The vulnerability is rated with a CVSS 3.1 score of 7.5 (High), indicating network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation level or patch is confirmed in the provided data. The Red Hat advisory URL is provided but does not contain explicit patch or mitigation details in the input.

Successful exploitation allows attackers with the ability to run sandboxed Groovy scripts to bypass sandbox restrictions and execute arbitrary code outside the sandbox environment. This can compromise system confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-57281 for current remediation guidance. No official fix or temporary workaround is stated in the provided information. Until a patch is available, restrict the ability to run sandboxed Groovy scripts to trusted users only.