CVE-2026-92129CWE-693

CVE-2026-92129

High · published September 16, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute code outside the sandbox.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.7th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-09-16T18:17Z
Affected products (1)
ProductVersionsFixed in
jenkins/script_security≤ 1415.v9a_f9b_3a_c253d—
References (1)
https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3977 · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 13:53Z
    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at…
    cvelistv5