CVE-2026-117621: CVE-2026-117621 (Jenkins Patches 15 Core Flaws)

Executive Summary & Technical Impact

The October 28 advisory fixes 13 high-severity bugs in Jenkins weekly 2.587 and LTS 2.580.1, many found by Anthropic's OSS program. Upgrade to 2.588 or LTS 2.580.2.

Tracked under CVE-2026-117621 (CWE-Other (Security Advisory)), this vulnerability affects Jenkins weekly 2.587 and earlier; Jenkins LTS 2.580.1 and earlier and carries a severity score of 8.0 (HIGH). Engineering and security operations teams running Jenkins Infrastructure should prioritize upgrading to Jenkins weekly 2.588; Jenkins LTS 2.580.2.

Remediation & Patch Guidance

1. The Jenkins Security Advisory of October 28, 2026 fixes 15 core vulnerabilities, 13 rated High and 2 Medium, in weekly 2.587 and earlier and LTS 2.580.1 and earlier.
2. CVE-2026-117612 lets attackers with Overall/Read and a user account instantiate arbitrary types through XStream's resolves-to attribute, potentially leading to remote code execution.
3. CVE-2026-117618 is a setup-wizard race that lets unauthenticated attackers create an administrator account while the initial account is being replaced.
4. Several file read, file write, and agent launch flaws can also lead to code execution on the controller. Upgrade to Jenkins 2.588 or LTS 2.580.2.

Frequently Asked Questions (CVE-2026-117621)

What versions are affected by CVE-2026-117621?

CVE-2026-117621 affects Jenkins weekly 2.587 and earlier; Jenkins LTS 2.580.1 and earlier in Jenkins Infrastructure (CVE-2026-117621 (Jenkins Patches 15 Core Flaws)).

How do I patch or remediate CVE-2026-117621?

Upgrade affected deployments to Jenkins weekly 2.588; Jenkins LTS 2.580.2 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-117621?

CVE-2026-117621 is rated HIGH with a CVSS score of 8.0 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).