High severity8.8NVD Advisory· Published Sep 2, 2026· Updated Sep 2, 2026
CVE-2026-84670
CVE-2026-84670
Description
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1015.v09ca_52b_3370e
Patches
Vulnerability mechanics
References
1News mentions
1- Jenkins Security Advisory 2026-09-02Jenkins Security Advisories · Sep 2, 2026