For: people who run Jenkins themselves (self-managed servers, VPS, Docker, Kubernetes), infrastructure owners on teams that use Jenkins, and people who leave Jenkins to a distribution such as CloudBees or to a contractor. This article is based on the Jenkins project's advisory and the CVE and NVD records. It does not cover attack steps.
Developing: this page will be updated as more is published
- Who is affected
people who run Jenkins themselves (self-managed servers, VPS, Docker, Kubernetes), infrastructure owners on teams that use Jenkins, and people who leave Jenkins to a distribution such as CloudBees or to a contractor.
- Confirmed so farSee the table ↓
- The flaws
- Affected versions
- Exploitable without authentication
1 more
- Workarounds
- Not yet confirmed
- Any report of exploitation (none found in what this site checked)
- Whether CISA adds any of the CVEs to the Known Exploited Vulnerabilities catalog (not listed on November 3)
- NVD's assessment of two of the 15 (CVE-2026-117625 and 117626 are awaiting analysis)
- What to do nowSee the steps ↓
- Check your Jenkins version
- Update the controller
- Put newly installed instances first
3 more
- Review exposure and permissions
- After updating, review users, administrators and agents
- Replace credentials if anything looks suspicious
- Where to verify (source)All sources ↓
- Jenkins project, "Jenkins Security Advisory 2026-10-28" (October 28, 2026)
- Last checked
- As of November 3, 2026 (JST)
Follow-up plans and what we checked
The Jenkins advisory says 15 issues are fixed in weekly 2.588 and LTS 2.580.2. It rates 13 as High and 2 as Medium and gives no numeric scores. NVD has analysed 13 of them, with base scores from 5.4 to 8.8.
What to do today
Check your Jenkins version
Open Manage Jenkins > About Jenkins, or look at the version at the bottom right of the page. Weekly 2.587 and earlier and LTS 2.580.1 and earlier are affected. With Docker, check the version inside the running container rather than the image tag; a moving tag such as lts points to different content before and after you pull. For distributions such as CloudBees, or Jenkins run by a contractor, read the provider's notice for the fixed version and ask the person responsible.
Update the controller
Update to weekly 2.588 or later, or LTS 2.580.2 or later. Back up JENKINS_HOME, which holds job and plugin configuration, somewhere off the server first. Afterwards check that login, running a job and connecting agents all work.
Put newly installed instances first
CVE-2026-117618 (SECURITY-4122) lets an unauthenticated user create an administrator account during initial setup. NVD rates it 8.1 (attack complexity High). If you are setting up a new Jenkins that is reachable from the internet, or are about to, run the setup on the fixed version in a place that is not reachable from outside.
Review exposure and permissions
By default Jenkins belongs on an internal or dedicated network, not directly on the internet. If it has to be reachable, put it behind a VPN or an authenticating proxy. Also check for setups left on "Logged-in users can do anything" and for anonymous users granted Overall/Read. Several of the 15 issues in the advisory depend on Overall/Read.
After updating, review users, administrators and agents
Look through the user list, accounts with administrator rights and node (agent) configuration for anything you do not recognise. Be most thorough if people with permissions had access while you were unpatched. If a "Manage Old Data" warning appears that you do not recognise, do not act on it.
Replace credentials if anything looks suspicious
If you find a suspicious account or setting, replace administrator and user passwords, API tokens and credentials stored in Jenkins (cloud keys, repository keys). How to proceed is covered in how to check whether an account was used without permission and the vulnerability-response playbook.
New and internet-exposed
Highest priority. Finish setup on the fixed version, off the internet
Many people hold permissions
Update soon, then review users, administrators and agents
Internal only, few permissions
Update on schedule and review settings at the same time
What the advisory says
The Jenkins project published "Jenkins Security Advisory 2026-10-28" on October 28, 2026. It covers Jenkins core and no plugins.
- Affected versions
- Weekly 2.587 and earlier, LTS 2.580.1 and earlier. The advisory says all prior versions are considered affected unless otherwise indicated
- Fixed versions
- Weekly 2.588, LTS 2.580.2
- Count and severity
- 15 issues. The advisory rates 13 High and 2 Medium (CVE-2026-117625 and 117626). It gives no numeric scores
- Workarounds
- Settings to switch off new checks if the update causes problems (SECURITY-4125, 4225), and enforced Content Security Policy on 2.539+ and LTS 2.541.1+ (for SECURITY-4225 it mitigates the ‘known impact’, with other XSS or vulnerability types possibly still possible; for SECURITY-4229 and 4232 it mitigates ‘this vulnerability’). No workaround is given for the others
- Exploitation
- The advisory does not mention exploitation
- Published
- All 15 were published on October 28, 2026 by the Jenkins project as CNA. The version ranges match the advisory
- NVD assessment (as of November 3)
- 13 are analysed, with CVSS v3.1 base scores from 5.4 to 8.8. CVE-2026-117625 and 117626 are awaiting analysis. The advisory's High and Medium and NVD's scores come from different assessors, so they do not always line up
The 15 issues, grouped by impact
The permission column is what the advisory says an attacker needs. The NVD column is NVD's CVSS v3.1 base score.
| Impact | CVE (SECURITY-ID) | Advisory severity | What the attacker needs (advisory) | NVD |
|---|---|---|---|---|
| Code may run on the controller | CVE-2026-117612 (4125) | High | Overall/Read plus a user account, or permission to POST config.xml | 8.8 |
| CVE-2026-117614 (4123) | High | Agent/Configure | 7.2 | |
| CVE-2026-117616 (4188) | High | Overall/Read | 8.8 | |
| CVE-2026-117617 (4248) | High | Item/Configure | 8.1 | |
| Arbitrary file read (the advisory says it can lead to code execution) | CVE-2026-117615 (4187) | High | Item/Create and Item/Configure | 6.5 |
| Administrator account created or taken over | CVE-2026-117618 (4122) | High | None (unauthenticated), during initial setup | 8.1 |
| CVE-2026-117620 (4226) | High | Overall/Read; an administrator's action triggers it | 8.8 | |
| A session outlives its credential | CVE-2026-117619 (4189) | High | Possession of a user's API token | 8.1 |
| Creation of user records (confirmed impact limited) | CVE-2026-117624 (4243) | High | Not stated; no accounts able to log in can be created | 8.8 |
| Cross-site scripting (XSS) | CVE-2026-117613 (4225) | High | Item/Configure | 5.4 |
| CVE-2026-117623 (4229) | High | Overall/Read | 5.4 | |
| CVE-2026-117621 (4232) | High | Control of an agent process | 6.1 | |
| CVE-2026-117622 (4249) | High | Control of an agent process | 6.1 | |
| Limited information disclosure | CVE-2026-117625 (4206) | Medium | Overall/Read (HTTP proxy settings visible) | Awaiting analysis |
| CVE-2026-117626 (4237) | Medium | Overall/Read (file names, sizes and modification times visible); with Item/Workspace, also the names of jobs that have a workspace on the same agent | Awaiting analysis |
A note on reading this: some NVD scores are lower than the advisory's "High". They are separate assessments, and neither is simply wrong. This site's position is to update promptly even where a permission is required, because Jenkins typically holds secrets and deployment rights.
Exploitation
As of November 3, 2026 this site found no credible report that these vulnerabilities have been exploited. The Jenkins advisory does not mention exploitation either.
- Jenkins advisory
- No mention of exploitation
- KEV
- None of CVE-2026-117612 to 117626 is in CISA's KEV catalog (last updated October 30). KEV lists six past vulnerabilities in Jenkins and related products such as plugins
This site's view: no report is not the same as safe. The fix is only days old and the picture may change. Jenkins is a product that has been exploited before, so update internet-facing and broadly permissioned instances without waiting for reports.
What is known and not known
| Item | What was published | Status |
|---|---|---|
| The flaws | 15 in core (13 High, 2 Medium), fixed in 2.588 and LTS 2.580.2 (Jenkins advisory) | Confirmed (Jenkins) |
| Affected versions | Weekly 2.587 and earlier, LTS 2.580.1 and earlier (advisory, CVE records) | Confirmed (Jenkins) |
| Exploitable without authentication | CVE-2026-117618 only, during initial setup (advisory) | Confirmed (Jenkins) |
| Workarounds | Only settings for post-update problems and enforced CSP for XSS; none for the rest | Confirmed (Jenkins) |
| Numeric scores | None in the advisory; NVD analysed 13 (5.4 to 8.8), 2 awaiting | Partial (NVD) |
| Exploitation | No report found in what this site checked | None reported |
| CISA KEV | Not listed as of November 3 | Not listed |
| Plugins | This advisory covers core only | Not covered (advisory) |
If someone else runs Jenkins for you
For Docker images, Kubernetes Helm charts, distributions such as CloudBees and Jenkins run by a contractor, make sure you can see the Jenkins core version inside. Three questions get things moving:
- What Jenkins version is running (2.588 or later, or LTS 2.580.2 or later)?
- When will it be updated, or when was it?
- Is it reachable from the internet, and do anonymous users have any permissions?
This site's view: the issue is less each flaw than how much power Jenkins holds
Jenkins tends to be where source code, cloud keys and deployment rights meet. A flaw in core can therefore become a problem for your whole build and release pipeline. Besides updating, review on a regular basis who has which permission, whether Jenkins is reachable from outside, and how many credentials it stores. For how to prioritise see how to prioritise vulnerabilities (CVSS, EPSS, KEV).
Timeline
October 28, 2026
The Jenkins project publishes its security advisory. 15 core issues are fixed in 2.588 and LTS 2.580.2, and CVE-2026-117612 to 117626 are published.By November 3
NVD analyses 13 of the 15 (base scores 5.4 to 8.8); 2 are awaiting analysis.November 3
This site checks the advisory, the CVE and NVD records and KEV. No report of exploitation is found, and none of the CVEs is in KEV.
Sources (public record)
Checked on November 3, 2026. The official advisory comes first.
- Jenkins project, "Jenkins Security Advisory 2026-10-28" (October 28, 2026) — jenkins.io
- CVE-2026-117612 to 117626 (published October 28, 2026 by the Jenkins project) — cve.org (example: CVE-2026-117618) / nvd.nist.gov (example: CVE-2026-117618)
- CISA Known Exploited Vulnerabilities catalog (checked on November 3 for these 15 CVEs; data last updated October 30) — cisa.gov / JSON
Update history
2026-11-03: First version, based on the Jenkins advisory 2026-10-28 and the CVE and NVD records. As of November 3 no report of exploitation was found and none of the CVEs is in KEV.
Read next
- Updating a self-hosted development platform: GitLab's emergency patch (CVE-2026-110264)
- After disclosure: the vulnerability-response playbook / how to prioritise vulnerabilities (CVSS, EPSS, KEV)
- Preparation: Security inventory checklist / How to check whether an account was used without permission
- Terms: What is RCE (remote code execution) / What is XSS / What is path traversal / What is CVSS