CVE-2026-84659 — Jenkins Project / Jenkins Script Security Plugin

CVE-2026-84659

Jenkins Project / Jenkins Script Security Plugin PUBLISHED

Description (CNA)

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins Script Security Plugin	affected 0 through 1412.v7737b_3405f86

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3986

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.