CVE-2026-84677

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-02 · updated 2026-09-03
Weakness: CWE-79

Description

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.

Affected products

Jenkins Project Jenkins update-center2: through 3.18.3

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4038

Get alerted when CVE-2026-84677 or the next vulnerability affects your stack