CVE-2026-117612

Vulnerability Description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.

References

https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4125

FAQ

What is CVE-2026-117612?

CVE-2026-117612 is a documented vulnerability. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.

How severe is CVE-2026-117612?

CVSS scoring is not yet available for CVE-2026-117612. Check NVD for updates.

Is there a patch for CVE-2026-117612?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.