CVE-2026-27099 — Jenkins Project / Jenkins

CVE-2026-27099

Jenkins Project / Jenkins PUBLISHED

Description (CNA)

Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins	unaffected 0 before 2.483; unaffected 2.551 before ; unaffected 2.541.2 before 2.541.

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2026-02-18/#SECURITY-3669

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.