CVE-2026-70426Patch

LOWCVSS 9.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911

Weakness type (CWE)

CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Patch or workaround signal is available
13 mentions across 6 observed days
Momentum state: declining

What's happening

Patch or workaround mentioned in 9 signals
Technical details provided in 12 signals
Disclosure: 5 classified signals
General: 1 classified signal
Peaked 5d ago at 8 mentions (2026-08-06); latest day: 1
13 total mentions across 6 days

Deep dive

Activity timeline13 mentions / 6d

Signal classification3 categories

Patch

753.8%

Disclosure

538.5%

General

17.7%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-06	8	Disclosure3General1Patch4
2026-08-07	1	Patch1
2026-08-13	1	Patch1
2026-08-14	1	Disclosure1
2026-10-02	1	Patch1
2026-10-03	1	Disclosure1

Full discourse13 posts

ThreatWire@ThreatWire_91d
Disclosure
🚨 CVE-2026-70426: A critical Jenkins vulnerability allows attackers to bypass the JEP-200 filter and achieve remote code execution (RCE) on the controller. Organizations using affected Jenkins instances should apply security updates immediately. #Jenkins #CVE #RCE #DevSecOps #CyberSecurity #Infosec
Post summary
The post announces the critical Jenkins CVE‑2026‑70426 vulnerability that allows RCE by bypassing the JEP‑200 filter and urges immediate application of security updates.
116076248.4K
1.7K followersView on X
Daily CyberSecurity@Daily_CyberSec91d
Patch
Critical Jenkins vulnerability CVE-2026-70426 lets attackers bypass the JEP-200 filter and run code on the controller. Patch now. #Jenkins #CVE202670426 #RCE #DevSecOps #Deserialization #CyberSecurity https://securityonline.info/jenkins-cve-2026-70426-rce/ https://t.co/pgLngxWbEK
Post summary
Jenkins CVE-2026-70426 allows attackers to bypass the JEP-200 filter and achieve remote code execution; a patch has already been released.
0901611.1K
13.0K followersView on X
Es Geeks@EsGeeks90d
Patch
🚨 Jenkins crítico (CVE-2026-70426): agents pueden ejecutar código en el controller por bypass del filtro JEP-200. Afecta ≤2.575 y LTS ≤2.568.1. Actualiza YA a 2.576 / 2.568.2. #Jenkins #CVE202670426 #DevSecOps https://t.co/oX2cQz9MeN
Post summary
The tweet reveals a critical Jenkins vulnerability (CVE‑2026‑70426) that allows agents to execute code on the controller via a JEP‑200 filter bypass, and urges users to update to 2.576 or 2.568.2 immediately.
100101980
22.5K followersView on X
kokumօtօ@__kokumoto90d
Patch
Jenkinsで重大(Critical)（公式）な脆弱性が修正。CVE-2026-70426はデシリアライゼーションフィルタ(JEP-208)の回避で、遠隔コード実行。要Agent/Connectパーミッション。その他22件の脆弱性と併せ修正。 https://securityonline.info/jenkins-cve-2026-70426-rce/
Post summary
The post announces that Jenkins CVE‑2026‑70426, a critical remote code execution flaw due to a deserialization filter bypass, has been patched.
010431.0K
7.8K followersView on X
iototsecnews@iototsecnews83d
Disclosure
Jenkins の深刻な脆弱性 CVE-2026-70426 が FIX：任意のコード実行の可能性 https://iototsecnews.jp/2026/08/06/critical-jenkins-deserialization-flaw-allows-attackers-to-execute-code-on-controllers/ Jenkins における脆弱性 CVE-2026-70426 について解説する記事です。エージェントとコントローラの間でデータを受け渡す仕組みに不備があり、安全性を高めるための制限が一部で機能しない状態になっています。この問題を突かれると、中央のシステム内部で悪意のプログラムを動かされ、保管されている鍵情報やソースコードなどの重要資産が奪われる危険があります。システムを安全に利用するためにも、対象製品を最新版へ速やかに更新し、接続権限の見直しを進めることが推奨されます。 #CVE202670426 #Jenkins #Vulnerability
Post summary
The post discloses a severe Jenkins deserialization flaw (CVE‑2026‑70426) that could enable arbitrary code execution, and it urges users to apply the latest fixes and tighten access controls.
01000181
507 followersView on X
Stanislav Klevtsov@stansecure84d
Patch
Top #CVE to #patch this week 👀 - @VMware #ESXi 9.0 RCE (CVE-2026-47876, CVE-2026-41703) - @JetBrains #TeamCity RCE (CVE-2026-63077, CVE-2026-65907) - #Jenkins Core (CVE-2026-70426) - @zohocorp ManageEngine ADAudit RCE (CVE-2026-6516) - @IBM Langflow RCE (CVE-2026-9198) - @ApacheKylin OS command injection (CVE-2026-62392) - #MOVEit auth bypass (CVE-2026-4670) - @giteaio unauth file read (CVE-2026-59774)
Post summary
The tweet enumerates several recent CVEs requiring patch this week, providing basic vulnerability type details but no evidence of exploitation, PoC, or false positives.
1000073
44 followersView on X
IntegSec@integ_sec32d
Disclosure
CVE-2026-70426: Jenkins Remoting Deserialization Filter Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04z5Q7X0
Post summary
The text announces CVE-2026-70426 as a Jenkins Remoting Deserialization Filter Bypass vulnerability and outlines its business implications and response, but it lacks specific details on exploits, patches, or active exploitation, based solely on the provided title and link.
0000037
35 followersView on X
Merge News@mergenewsapp34d
Patch
Urgent: Patch Jenkins now! A critical deserialization vulnerability (CVE-2026-70426) in Remoting allows unauthenticated RCE, risking your CI/CD. #security #vulnerability #rce #patching https://merge.news/post/pFrSvqfRCLHEVKJCwEk1
Post summary
The tweet reports a critical deserialization vulnerability (CVE-2026-70426) in Jenkins Remoting that allows unauthenticated remote code execution and urges immediate patching. It provides no proof-of-concept, exploit code, or evidence of active exploitation.
0000051
75 followersView on X
lee1981@lee1981b90d
Patch
🔥 CyberForge CVE of the Day #018 🚨 CVE-2026-70426 — Jenkins Agent-to-Controller Deserialization Filter Bypass A critical flaw in Jenkins Remoting can let a compromised or attacker-controlled agent bypass the JEP-200 deserialization class filter and potentially execute code on the Jenkins controller. ⭐ CVSS: 9.0 Critical ⭐ CWE: CWE-502 — Deserialization of Untrusted Data ⭐ Privileges Required: None ⭐ User Interaction: None ⭐ Exploitation: None observed ⭐ Technical Impact: Total ⚠️ Why It Matters. Jenkins agents are intentionally less trusted than the controller. CVE-2026-70426 breaks part of that boundary because a fallback class-resolution path failed to apply JEP-200 filtering. A successful attack could expose: • Jenkins credentials and API tokens • cloud and deployment secrets • pipeline configuration • build artefacts • connected production infrastructure A controller compromise may become a software supply-chain incident. 🛡️ Affected / Fixed. Affected: • Jenkins 2.575 and earlier • LTS 2.568.1 and earlier Fixed: • Jenkins 2.576 • LTS 2.568.2 The Remoting fix also applies the JEP-200 filter to the fallback resolution path. 🔍 Detection: Watch for unusual agent reconnects, suspicious Agent/Connect activity, unexpected changes to JENKINS_HOME, and the Jenkins Java process spawning cmd.exe, PowerShell, sh, bash, curl or wget. 🔧 Remediation: Upgrade immediately and verify the corrected Remoting version. Disconnect suspicious agents, review Agent/Connect permissions, and rotate Jenkins/cloud/deployment credentials if controller compromise is suspected. 🔗 https://nvd.nist.gov/vuln/detail/CVE-2026-70426 #CyberForge #CVE202670426 #Jenkins #JenkinsSecurity #JEP200 #Deserialization #CICD #SupplyChain #BlueTeam
Post summary
The post announces a high‑severity deserialization vulnerability in Jenkins Remoting, provides detailed technical information, and emphasizes patching and remediation steps.
0000068
546 followersView on X
CCB Alert@CCBalert90d
Patch
Warning: Critical agent-to-controller deserialization filter bypass in #Jenkins. #CVE-2026-70426 CVSS: 9.0. This vulnerability can lead to #RCE on the controller! #Patch #Patch #Patch More info: https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911
Post summary
Jenkins CVE-2026-70426 is a critical deserialization flaw that can lead to RCE, and a patch is already available as per the official advisory.
00000454
7.2K followersView on X
Undercode News@undercode_news90d
Disclosure
🚨 Critical Jenkins Vulnerability Exposes Build Controllers: #CVE-2026-70426 Could Turn Trusted Automation Into an Attacker’s Gateway + Video -Fact Checker: ✅: 3 ❌: 0 || 3/3 → Score: 100% 🦾 -Prediction: 📈 1 Positive | 📉 0 Negative http://undercodenews.com/critical-jenkins-vulnerability-exposes-build-controllers-cve-2026-70426-could-turn-trusted-automation-into-an-attackers-gateway-video/
Post summary
The tweet announces a critical Jenkins vulnerability (CVE‑2026‑70426) and suggests it could give attackers access through trusted automation, but it offers no technical details, proof‑of‑concept, or evidence of exploitation.
0000046
42 followersView on X
Upwind Security MDR@UpwindMDR90d
Disclosure
🚨Critical - Jenkins Remoting JEP-200 Deserialization Filter Bypass (CVE-2026-70426) In Jenkins Remoting, the JEP-200 class filter isn’t enforced for classes resolved via a fallback deserialization path, letting attacker-controlled agents bypass the filter for Jenkins core classpath classes. Exploitable by agent processes/code on agents or anyone with Agent/Connect to trigger unsafe deserialization and potentially RCE. 👉Affected: Jenkins Remoting <= 3384.v60d89463d9e0 (except 3355.3357.v931d3c992987); Jenkins <= 2.575 / LTS <= 2.568.1
Post summary
A critical Jenkins Remoting deserialization filter bypass (CVE-2026-70426) is announced, detailing how agent processes may exploit the flaw for remote code execution; no patch or PoC is referenced.
00000103
282 followersView on X
キタきつね@foxbook91d
General
CVE-2026-70426: Jenkinsの重大なリモートコード実行の脆弱性により、逆シリアル化フィルタが回避される CVE-2026-70426: Critical Jenkins RCE Flaw Bypasses Deserialization Filter #DailyCyberSecurity (Aug 6) https://securityonline.info/jenkins-cve-2026-70426-rce/
Post summary
The note announces a critical Jenkins remote code execution flaw (CVE‑2026‑70426) that bypasses the deserialization filter, linking to a blog‑style discussion.
00000309
4.9K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-70426

ThreatWire[verified]@ThreatWire_Disclosure

The post announces the critical Jenkins CVE‑2026‑70426 vulnerability that allows RCE by bypassing the JEP‑200 filter and urges immediate application of security updates.

kokumօtօ[verified]@__kokumotoPatch

The post announces that Jenkins CVE‑2026‑70426, a critical remote code execution flaw due to a deserialization filter bypass, has been patched.

Stanislav Klevtsov[verified]@stansecurePatch

The tweet enumerates several recent CVEs requiring patch this week, providing basic vulnerability type details but no evidence of exploitation, PoC, or false positives.

IntegSec[verified]@integ_secDisclosure

The text announces CVE-2026-70426 as a Jenkins Remoting Deserialization Filter Bypass vulnerability and outlines its business implications and response, but it lacks specific details on exploits, patches, or active exploitation, based solely on the provided title and link.

Merge News[verified]@mergenewsappPatch

The tweet reports a critical deserialization vulnerability (CVE-2026-70426) in Jenkins Remoting that allows unauthenticated remote code execution and urges immediate patching. It provides no proof-of-concept, exploit code, or evidence of active exploitation.

lee1981[verified]@lee1981bPatch

The post announces a high‑severity deserialization vulnerability in Jenkins Remoting, provides detailed technical information, and emphasizes patching and remediation steps.

Undercode News[verified]@undercode_newsDisclosure

The tweet announces a critical Jenkins vulnerability (CVE‑2026‑70426) and suggests it could give attackers access through trusted automation, but it offers no technical details, proof‑of‑concept, or evidence of exploitation.

Upwind Security MDR[verified]@UpwindMDRDisclosure

A critical Jenkins Remoting deserialization filter bypass (CVE-2026-70426) is announced, detailing how agent processes may exploit the flaw for remote code execution; no patch or PoC is referenced.