Intel

CVE-2026-70426

A flaw was found in Jenkins Remoting (CVE-2026-70426)

criticalEPSS 0.4%

Affected

  • bitnami/jenkins 2.569.0..*

Description

A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.

Source: redhat_csafOSV (Open Source Vulnerabilities)NVD (NIST)cvelistv5BSI WID PortalBSI CSAF

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

bitnamijenkins
2.569.0

Metrics

XIEM Effective CVSS
9.0
Source: nvd-v3
EPSS percentile
37.4 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
81.93
Exploit maturity
no public PoC known
CVSS v3
9.0
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-17 05:44 UTC

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-08-06 05:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-70426","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI… → {"id":"CVE-2026-70426","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  2. CVE Modified2026-08-05 19:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • CVSS V3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    • CWE: CWE-502
    • SSVC: {"id":"CVE-2026-70426","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  3. New CVE Received2026-08-05 18:17 UTC· jenkinsci-cert@googlegroups.com
    • Affected: Jenkins, Remoting
    • Description: In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.
    • Reference: https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911

Linked advisories