What is CVE-2026-92128?

CVE-2026-92128 is a high-severity vulnerability in Jenkins Project Script Security Plugin, classified under Download of Code Without Integrity Check. CVSS score: 7.5/10. Published 2026-09-16.

How severe is CVE-2026-92128?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Jenkins Project Script Security Plugin

CVE-2026-92128

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Jenkins Project Script Security Plugin

Weakness classification (CWE)

CWE-494 — Download of Code Without Integrity Check

References

jenkinsci-cert@googlegroups.com (vendor-advisory)

Frequently asked questions

What is CVE-2026-92128?: CVE-2026-92128 is a high-severity vulnerability in Jenkins Project Script Security Plugin, classified under Download of Code Without Integrity Check. CVSS score: 7.5/10. Published 2026-09-16.
How severe is CVE-2026-92128?: High severity. CVSS v3 base score is 7.5 out of 10.