CVE-2026-70426
CRITICALJenkins Remoting 3355.3357.v931d3c992987-3384.v60d89463d9e0 - Deserialization Filter Bypass via JEP-200 Fallback Path
Title source: llmDescription
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.
References (1)
Core 1
Core References
Vendor Advisory vendor-advisory
Jenkins Security Advisory 2026-08-05
https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911
Scores
CVSS v3
9.0
EPSS
0.0029
EPSS Percentile
21.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-502
Status
published
Products (4)
Jenkins Project/Jenkins
2.568.2 - 2.568.*
Jenkins Project/Jenkins
2.576
Jenkins Project/Remoting
3355.3357.v931d3c992987 - 3355.*
Jenkins Project/Remoting
3385.vf1123fb_515da_
Published
Aug 05, 2026
Tracked Since
Aug 05, 2026