CVE-2026-92127CWE-94code-injection

CVE-2026-92127

High · published September 16, 2026

CVSS v3.1
8.0
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00610 · 48.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-16T18:17Z
Affected products (1)
ProductVersionsFixed in
jenkins/script_security≤ 1415.v9a_f9b_3a_c253d—
References (1)
https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3897 · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 13:53Z
    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with…
    cvelistv5