Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 Newly rated high, disclosed Oct 28 Jenkins: security restriction bypass in config deserialization (CVE-2026-117624) Attackers can bypass a deserialization restriction and potentially inject nested objects into configuration. No patch listed yet https://cve.now/CVE-2026-117624?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jenkins | jenkins | - | - | - |
| App | jenkins | jenkins | - | - | - |