CVE-2026-117613

CVE-2026-117613: vulnerability in Jenkins

Published

Follow this CVE+ Monitor Jenkins

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.3%
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.
Affected products
Jenkins Project · Jenkins
Related CVEs — Jenkins

In the same product, most dangerous first.

CVE-2024-23897CRITICALCVE-2024-23897EPSS 100.0%KEVCVE-2024-23898HIGHCVE-2024-23898EPSS 67.2%CVE-2026-53435HIGHCVE-2026-53435EPSS 53.1%CVE-2024-43044HIGHCVE-2024-43044EPSS 28.8%CVE-2025-59474MEDIUMCVE-2025-59474EPSS 5.0%CVE-2023-43494—CVE-2023-43494EPSS 3.9%