What is CVE-2026-84650?

CVE-2026-84650 is a high-severity vulnerability, classified under Deserialization of Untrusted Data. CVSS score: 8.8/10. Published 2026-09-02.

How severe is CVE-2026-84650?

High severity. CVSS v3 base score is 8.8 out of 10.

CVE-2026-84650

CVE-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

Vulnerability class: Insecure Deserialization

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data
CWE-566 — Authorization Bypass Through User-Controlled SQL Primary Key

References

jenkinsci-cert@googlegroups.com (vendor-advisory)

Frequently asked questions

What is CVE-2026-84650?: CVE-2026-84650 is a high-severity vulnerability, classified under Deserialization of Untrusted Data. CVSS score: 8.8/10. Published 2026-09-02.
How severe is CVE-2026-84650?: High severity. CVSS v3 base score is 8.8 out of 10.