CVE-2026-70426

CRITICAL

Jenkins Remoting JEP-200 Deserialization Filter Bypass

Generated titleSource: EIP title enrichment
STIX 2.1 vulnerability

Record summary

CVE-2026-70426 has a selected CVSS score of 9.0 (critical).

Description

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Jenkins

Browse Jenkins Project / Jenkins

Default status: affected

CVE List2.576 to < *unaffected
2.568.2 to < 2.568.*unaffected

Remoting

Browse Jenkins Project / Remoting

Default status: affected

CVE List3385.vf1123fb_515da_ to < *unaffected
3355.3357.v931d3c992987 to < 3355.*unaffected

Research & analysis

1
Technical blogTamilselvan / Cyber PressSource: EIP research review

Critical Jenkins Vulnerability Exposes Build Servers to Controller Takeover

The Jenkins Security Advisory 2026-08-05 discloses CVE-2026-70426 (SECURITY-3911), a critical vulnerability in the Remoting library where the JEP-200 class filter is not applied to classes resolved via a fallback deserialization path. This affects Remoting 3384.v60d89463d9e0 and earlier (except 3355.3357.v931d3c992987), included in Jenkins 2.575 and earlier and LTS 2.568.1 and earlier. Agent processes, code running on agents, and attackers with Agent/Connect permission can bypass the deserialization filter for classes on the Jenkins core classpath, which could be leveraged to execute code on the controller. The fix is in Jenkins 2.576 and LTS 2.568.2. An official Java agent workaround is available in the jenkinsci-cert/SECURITY-3911-3930 repository. The advisory does not confirm active exploitation. The advisory also covers CVE-2026-70427 (SECURITY-3930), a separate link-following vulnerability in tar extraction.

Root causeTechnical detailExploitationMitigation
https://cyberpress.org/critical-jenkins-vulnerability
Research notes
  • Root cause
    The JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing bypass of the deserialization filter for classes on the Jenkins core classpath.
    Jenkins Security Advisory 2026-08-05
  • Technical detail
    The vulnerability affects Remoting 3384.v60d89463d9e0 and earlier (except 3355.3357.v931d3c992987), included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier. The fix applies the class filter on the fallback code path in Jenkins 2.576 and LTS 2.568.2.
    Jenkins Security Advisory 2026-08-05
  • Exploitation
    The advisory does not confirm active exploitation. The vulnerability can be exploited by agent processes, code already executing on Jenkins agents, or users with Agent/Connect permission.
    Jenkins Security Advisory 2026-08-05
  • Mitigation
    Fixed in Jenkins weekly 2.576 and LTS 2.568.2. An official Java agent workaround is available in the jenkinsci-cert/SECURITY-3911-3930 GitHub repository for administrators unable to upgrade immediately.
    SECURITY-3911 / SECURITY-3930 Workaround Jenkins Security Advisory 2026-08-05
Supporting sources
ReferenceSECURITY-3911 / SECURITY-3930 Workaround
ReferenceJenkins Security Advisory 2026-08-05

References

1