# Jenkins core: 15 vulnerabilities including XStream deserialization RCE and a setup-wizard admin takeover race (Jenkins 2.588, LTS 2.580.2) · pwn.watch > The Jenkins project published a core security advisory on Oct 28 fixing 15 vulnerabilities in Jenkins weekly 2.587 and earlier and LTS 2.580.1 and earlier, 13 rated High and 2 Medium. The most serious: CVE-2026-117612 lets attackers with Overall/Read and a user account (or any config.xml POST permission) instantiate arbitrary types through XStream's resolves-to attribute, potentially leading to remote code execution. CVE-2026-117614 lets users with Agent/Configure run arbitrary code on the controller through unapproved legacy agent launch commands. CVE-2026-117615, CVE-2026-117616 and CVE-2026-117617 allow arbitrary file read, config.xml overwrite and arbitrary file writes on the controller that can lead to code execution. CVE-2026-117618 is a race in the setup wizard that lets unauthenticated attackers create an administrator account while the initial account is being replaced, and CVE-2026-117620 lets Overall/Read users take over accounts through the Manage Old Data feature. The rest are stored XSS, a remember-me cookie that survives API token revocation, and information leaks. All are fixed in Jenkins 2.588 and LTS 2.580.2. Many were reported by the Anthropic OSS program. Page: https://pwn.watch/i/jenkins-core-security-advisory-2026-10-28 · generated 2026-10-28T20:28:01.475Z ## Status - Severity: high · status: live · patch: patched - Product: Jenkins (core), weekly and LTS - Started: 2026-10-28 - CVEs: CVE-2026-117612, CVE-2026-117613, CVE-2026-117614, CVE-2026-117615, CVE-2026-117616, CVE-2026-117617, CVE-2026-117618, CVE-2026-117619, CVE-2026-117620, CVE-2026-117621, CVE-2026-117622, CVE-2026-117623, CVE-2026-117624, CVE-2026-117625, CVE-2026-117626 - Affected: Jenkins weekly 2.587 and earlier; Jenkins LTS 2.580.1 and earlier - Fixed in: Jenkins weekly 2.588; Jenkins LTS 2.580.2 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/jenkins-core-security-advisory-2026-10-28/feed.xml - JSON Feed: https://pwn.watch/i/jenkins-core-security-advisory-2026-10-28/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/jenkins-core-security-advisory-2026-10-28.json - This file: https://pwn.watch/i/jenkins-core-security-advisory-2026-10-28/llms.txt ## Updates (newest first) - 2026-10-28: Jenkins publishes Security Advisory 2026-10-28 for Jenkins core, fixing 15 vulnerabilities (SECURITY-4122 to SECURITY-4249, CVE-2026-117612 to CVE-2026-117626) in Jenkins 2.588 and LTS 2.580.2. (https://www.jenkins.io/security/advisory/2026-10-28/) ## Fix brief # Security brief: Jenkins core: 15 vulnerabilities including XStream deserialization RCE and a setup-wizard admin takeover race (Jenkins 2.588, LTS 2.580.2) Source: https://pwn.watch/i/jenkins-core-security-advisory-2026-10-28 · status: live · severity: high · updated Oct 28, 2026, 20:11 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is The Jenkins project published a core security advisory on Oct 28 fixing 15 vulnerabilities in Jenkins weekly 2.587 and earlier and LTS 2.580.1 and earlier, 13 rated High and 2 Medium. The most serious: CVE-2026-117612 lets attackers with Overall/Read and a user account (or any config.xml POST permission) instantiate arbitrary types through XStream's resolves-to attribute, potentially leading to remote code execution. CVE-2026-117614 lets users with Agent/Configure run arbitrary code on the controller through unapproved legacy agent launch commands. CVE-2026-117615, CVE-2026-117616 and CVE-2026-117617 allow arbitrary file read, config.xml overwrite and arbitrary file writes on the controller that can lead to code execution. CVE-2026-117618 is a race in the setup wizard that lets unauthenticated attackers create an administrator account while the initial account is being replaced, and CVE-2026-117620 lets Overall/Read users take over accounts through the Manage Old Data feature. The rest are stored XSS, a remember-me cookie that survives API token revocation, and information leaks. All are fixed in Jenkins 2.588 and LTS 2.580.2. Many were reported by the Anthropic OSS program. Severity detail: 13 of 15 issues rated High by the Jenkins project, 2 Medium; most need Overall/Read or a configure permission, but CVE-2026-117618 is unauthenticated during initial setup; no exploitation reported - Product: Jenkins (core), weekly and LTS - CVE / advisory ids: CVE-2026-117612, CVE-2026-117613, CVE-2026-117614, CVE-2026-117615, CVE-2026-117616, CVE-2026-117617, CVE-2026-117618, CVE-2026-117619, CVE-2026-117620, CVE-2026-117621, CVE-2026-117622, CVE-2026-117623, CVE-2026-117624, CVE-2026-117625, CVE-2026-117626 ## Affected versions - Jenkins weekly 2.587 and earlier - Jenkins LTS 2.580.1 and earlier ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Jenkins weekly 2.588 - Jenkins LTS 2.580.2 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Check the Jenkins controller version. If it is weekly 2.587 or earlier, upgrade to 2.588; if it is LTS 2.580.1 or earlier, upgrade to LTS 2.580.2. Until upgraded, limit Overall/Read and */Configure permissions to trusted users, and don't leave a new Jenkins instance reachable from untrusted networks while the setup wizard is unfinished (CVE-2026-117618). After upgrading, revoke API tokens you suspect were leaked and clear remember-me sessions, since older versions let a remember-me cookie outlive a revoked token (CVE-2026-117619). ## Latest updates - Oct 28, 2026: Jenkins publishes Security Advisory 2026-10-28 for Jenkins core, fixing 15 vulnerabilities (SECURITY-4122 to SECURITY-4249, CVE-2026-117612 to CVE-2026-117626) in Jenkins 2.588 and LTS 2.580.2. ## Advisories - [Jenkins Security Advisory 2026-10-28](https://www.jenkins.io/security/advisory/2026-10-28/) (Jenkins project) ## Caveats Jenkins credits the Anthropic OSS program for most of the issues, plus Jongyeon Lee (2jo), Bilishee (Xmirror Security Team) and Samy Medjahed (Ap4sh). New hardening in 2.588 and 2.580.2 can be relaxed with Java system properties if it breaks existing configs: hudson.util.XStream2.SUPPRESS_TYPE_PERMISSION and the hudson.util.RobustReflectionConverter.* properties listed in the advisory. --- Machine-readable: https://pwn.watch/i/jenkins-core-security-advisory-2026-10-28.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.