https://pwn.watch/i/jenkins-core-security-advisory-2026-10-28 The Jenkins project published a core security advisory on Oct 28 fixing 15 vulnerabilities in Jenkins weekly 2.587 and earlier and LTS 2.580.1 and earlier, 13 rated High and 2 Medium. The most serious: CVE-2026-117612 lets attackers with Overall/Read and a user account (or any config.xml POST permission) instantiate arbitrary types through XStream's resolves-to attribute, potentially leading to remote code execution. CVE-2026-117614 lets users with Agent/Configure run arbitrary code on the controller through unapproved legacy agent launch commands. CVE-2026-117615, CVE-2026-117616 and CVE-2026-117617 allow arbitrary file read, config.xml overwrite and arbitrary file writes on the controller that can lead to code execution. CVE-2026-117618 is a race in the setup wizard that lets unauthenticated attackers create an administrator account while the initial account is being replaced, and CVE-2026-117620 lets Overall/Read users take over accounts through the Manage Old Data feature. The rest are stored XSS, a remember-me cookie that survives API token revocation, and information leaks. All are fixed in Jenkins 2.588 and LTS 2.580.2. Many were reported by the Anthropic OSS program. en Wed, 28 Oct 2026 00:00:00 GMT https://pwn.watch/i/jenkins-core-security-advisory-2026-10-28 https://pwn.watch/i/jenkins-core-security-advisory-2026-10-28#2026-10-28-70722421 Wed, 28 Oct 2026 00:00:00 GMT high <p><a href="https://www.jenkins.io/security/advisory/2026-10-28/">Source</a></p>