CVE-2026-117612
Jenkins: unsafe deserialisation
- Risk score
- 55/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the resolves-to attribute during XStream deserialization.
- Affected
- Jenkins
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Jenkins: Yellow, plan it in. In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replace…
The flaws
- CVE-2026-117612: Unsafe deserialisation (CVSS 8.8 · EPSS 0%)
- CVE-2026-117618: Race condition (CVSS 8.1 · EPSS 0%)
- CVE-2026-117616: Path traversal can lead to remote code execution (CVSS 8.8 · EPSS 0%)
- CVE-2026-117620: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to… (CVSS 8.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Jenkins
Where it stands
- No known exploitation
Connects to
- Same weakness: Unsafe deserialisation (CWE-502). 333 other warnings in 30 days
- Same product: Earlier Jenkins warnings. 9 in the last 90 days
Why it is Yellow
- CVSS 8.8 high
References
Original description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.
Last activity 28 Oct 2026. Patch Forecast updates every hour.