CVE-2026-92122CWE-693

CVE-2026-92122

High · published September 16, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00632 · 49.6th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-09-16T18:17Z
Affected products (1)
ProductVersionsFixed in
jenkins/script_security≤ 1415.v9a_f9b_3a_c253d—
References (1)
https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3929 · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 1%
    epss
  • 16 SEP 13:53Z
    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a…
    cvelistv5