Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Jenkins patched 15 core flaws on Oct 28, among them an XStream deserialization RCE (CVE-2026-117612) and an unauthenticated admin-account race in the setup wizard (CVE-2026-117618); update weekly to 2.588 and LTS to 2.580.2. https://www.jenkins.io/security/advisory/2026-10-28/ #Jenkins https://t.co/9H3pc6AIYg