CVE-2026-84675: Vulnerability in Jenkins Project Jenkins TICS Plugin

This vulnerability in Jenkins TICS Plugin (version 2025.1.1 and earlier) permits OS command injection via build environment variables controlled by an attacker. Successful exploitation allows arbitrary command execution on the agent running the build, potentially impacting confidentiality, integrity, and availability of the build environment. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, and a scope change with partial impact on confidentiality, integrity, and availability.

An attacker with the ability to control build environment variables can execute arbitrary OS commands on the build agent. This can lead to unauthorized access, modification, or disruption of the build process and potentially the underlying system. The impact affects confidentiality, integrity, and availability partially as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict who can control build environment variables and limit build agent access to trusted users only.