CVE-2026-84650: Vulnerability in Jenkins Project Jenkins

CVE-2026-84650 is a deserialization vulnerability in Jenkins affecting versions 2.579 and earlier, and LTS 2.568.2 and earlier. The flaw arises because transient fields are not excluded from deserialization, enabling attackers with permission to submit configuration updates to manipulate these fields. The severity of the impact depends on the usage of these transient fields in the Jenkins environment. The CVSS score is 8.8 (high), indicating a network attack vector with low complexity, requiring low privileges but no user interaction, and resulting in high confidentiality, integrity, and availability impacts.

An attacker with the ability to submit configuration updates can exploit this vulnerability to manipulate transient fields during deserialization, potentially leading to full compromise of confidentiality, integrity, and availability of the Jenkins instance. The exact impact depends on how the transient fields are utilized by Jenkins or its plugins.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Jenkins security advisories for updates and apply patches once available. Until then, restrict configuration update permissions to trusted users only.