What is CVE-2026-92127?

CVE-2026-92127 is a high-severity vulnerability in Jenkins Project Script Security Plugin, classified under Code Injection. CVSS score: 8.0/10. Published 2026-09-16.

How severe is CVE-2026-92127?

High severity. CVSS v3 base score is 8.0 out of 10.

RCE in Jenkins Project Script Security Plugin

CVE-2026-92127

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Jenkins Project Script Security Plugin

Weakness classification (CWE)

CWE-94 — Code Injection

References

jenkinsci-cert@googlegroups.com (vendor-advisory)

Frequently asked questions

What is CVE-2026-92127?: CVE-2026-92127 is a high-severity vulnerability in Jenkins Project Script Security Plugin, classified under Code Injection. CVSS score: 8.0/10. Published 2026-09-16.
How severe is CVE-2026-92127?: High severity. CVSS v3 base score is 8.0 out of 10.