High severity8.8NVD Advisory· Published Sep 2, 2026· Updated Sep 3, 2026
CVE-2026-84670
CVE-2026-84670
Description
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1015.v09ca_52b_3370e
Patches
Vulnerability mechanics
References
1News mentions
3- ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and MoreThe Hacker News · Sep 7, 2026
- Jenkins: 25 Vulnerabilities Disclosed Together, Including RCE and XSS FlawsVypr Intelligence · Sep 2, 2026
- Jenkins Security Advisory 2026-09-02Jenkins Security Advisories · Sep 2, 2026