Do Son 
TL;DR
Jenkins fixed 20 plugin vulnerabilities in its September 16, 2026 advisory. Seven of them let attackers break out of the Script Security sandbox and run code on the controller. Most of these Jenkins plugin vulnerabilities are rated high severity.
- Total: 20 CVEs
- Severity: 11 High · 7 Medium · 1 Low · 1 Unrated
- Actively exploited: None confirmed
- Highest severity: 8.8 (High · CVSSv3) — CVE-2026-92122
- Action: Apply the latest security updates now
Track every Jenkins CVE the moment it's exploited.
Get free email alertsNotable CVEs
| CVE | CVSS (CVSSv3) | Fixed in | Status |
|---|---|---|---|
| CVE-2026-92122 | 8.8 | — | Not exploited |
| CVE-2026-92123 | 8.8 | — | Not exploited |
| CVE-2026-92124 | 8.8 | — | Not exploited |
| CVE-2026-92125 | 8.8 | — | Not exploited |
| CVE-2026-92137 | 8.8 | — | Not exploited |
| CVE-2026-92127 | 8 | — | Not exploited |
| CVE-2026-92134 | 8 | 13.10223.10225.vcf001b_b_b_3a_90, 13.10259.v80f407cb_03a_e | Not exploited |
| CVE-2026-92135 | 8 | 3.3325.3327.v26c59e218691, 3.3361.v0626103a_67e6 | Not exploited |
Why these Jenkins plugin vulnerabilities matter
Jenkins runs at the heart of many software build pipelines. A controller compromise can poison every build it manages. These Jenkins plugin vulnerabilities give attackers several paths to that goal.
The Script Security Plugin is the biggest concern. It powers the sandbox that keeps user scripts safe. Seven separate flaws break that sandbox, and each carries a high severity rating.
How the attacks work
Script Security sandbox bypasses
The sandbox intercepts unsafe Groovy operations before they run. The patched flaws slip past those checks in different ways. Some abuse interface coercion, null receivers, or collection casting. Others exploit Groovy annotations like @GroovyASTTransformationClass and @Builder at compile time.
In each case, an attacker who can define and run a sandboxed Pipeline escapes the sandbox. The result is arbitrary code execution in the Jenkins controller JVM. Two related flaws also target classpath approval and a TOCTOU race condition.
Other plugin risks
The advisory reaches beyond Script Security. A path traversal bug in the Robot Framework Plugin can lead to remote code execution. Several plugins carry stored XSS flaws, including Warnings, Coverage, and Dependency-Check. Two SSRF issues in the Gradle and Bitbucket plugins can capture stored credentials.
Affected versions
Each flaw affects specific plugin builds, not Jenkins core. Key examples include Script Security up to 1415.v9a_f9b_3a_c253d and Robot Framework up to 6.2.2. The Jenkins project confirms no active exploitation and no public proof-of-concept at this time. Many issues came through the Jenkins Bug Bounty Program.
Patch and mitigation steps
Update the affected plugins right away. Move Script Security to 1422.v06869826dd9b_ or later. Patch Robot Framework to 6.3.0 and the other named plugins to their fixed builds. Review the full Jenkins security advisory for the complete version list. Finally, limit who can configure jobs and define Pipeline scripts.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
