Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an…

Risk score
50/100
CVSS
8.1 v3.1
Exploit chance (30 days)
0.2%
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure per…
Affected
Jenkins
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: JenkinsTHE FLAWSTHE FIXCVE-2026-117617Jenkins 2.587 and earlier, LTS2.580.1 and earlier checks forsymbolic links in the path of…CVSS 8.1 · EPSS 0%CVE-2026-117618Race conditionCVSS 8.1 · EPSS 0%CVE-2026-117616Path traversal can lead toremote code executionCVSS 8.8 · EPSS 0%CVE-2026-117612Unsafe deserialisationCVSS 8.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedJenkinsYELLOW · PLAN IT INJenkinsIn Jenkins 2.587 and earlier,LTS 2.580.1 and earlier, theHTTP endpoint for creating thefirst user account does notcheck whether the setup wizardhas been completed, resulting ina race condition that allows…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-59 (CWE-59)103 other warnings in 30 days →Same productEarlier Jenkins warnings9 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Jenkins: Yellow, plan it in. In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replace…

The flaws

  • CVE-2026-117617: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an… (CVSS 8.1 · EPSS 0%)
  • CVE-2026-117618: Race condition (CVSS 8.1 · EPSS 0%)
  • CVE-2026-117616: Path traversal can lead to remote code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-117612: Unsafe deserialisation (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Jenkins

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.1 high

References

Original description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.

Last activity 28 Oct 2026. Patch Forecast updates every hour.