On September 2, 2026, the Jenkins project shipped a large-scale security update fixing more than 30 vulnerabilities in the widely used CI/CD server and its plugins. Several of the flaws carry a CVSS score of 9.9 and allow remote code execution.
The most dangerous flaw
The standout is CVE-2026-84645 (CVSS 9.9): a deserialization weakness lets serialized objects be nested in a way that grants attackers access to the otherwise protected Script Console, enabling arbitrary code execution on the controller. Affected are Jenkins 2.579 and earlier, plus the LTS line up to 2.568.2. Also rated critical are CVE-2026-84647 (unsafe object instantiation), CVE-2026-84670 in the Performance plugin, and CVE-2026-84671 in the File Parameter plugin.
Why it hits homelabs and self-hosters
Jenkins is the central automation hub in many homelabs, Docker setups, and corporate pipelines — often with far-reaching permissions and sometimes carelessly exposed to the internet. Remote code execution on the controller effectively means a full compromise of the build environment, including any stored secrets.
What to do now
Administrators should upgrade to Jenkins 2.580 or LTS 2.568.3 without delay and update all affected plugins. Where an immediate update is not possible, keep the Jenkins interface off the public internet and restrict access as tightly as possible.
Source: Jenkins Security Advisory 2026-09-02
