CVE-2026-84659CWE-862broken-access-control

CVE-2026-84659

Medium · published September 2, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-02T20:17Z
Affected products (1)
ProductVersionsFixed in
jenkins/script_security≤ 1412.v7737b_3405f86—
References (1)
https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3986 · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 15:40Z
    Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the…
    cvelistv5