CVE-2026-70426

State: Published
Severity: 9.0 Critical
Published: Aug 5, 2026
Updated: Aug 6, 2026
Reserved: Aug 4, 2026

Description

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
JenkinsJenkins Project	2.576 and laterNot affected 2.568.2 to before 2.568.*Not affected
RemotingJenkins Project	3385.vf1123fb_515da_ and laterNot affected 3355.3357.v931d3c992987 to before 3355.*Not affected

References

Jenkins Security Advisory 2026-08-05vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.