CVE-2026-84670
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached
CVSS
8.8
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Sep 2, 2026 · Last modified: Sep 2, 2026 · CWE-502
Not enough EPSS history yet.
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-846508.8 HIG—
——0In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.20hCVE-2026-846478.8 HIG—
——0In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing attackers with Overall/Read permission to instantiate types related to configuration for which that field type was not intended.20hCVE-2026-846464.3 MED—
——0In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.20hCVE-2023-33603.3 LOW—
——0The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.23hCVE-2026-817728.8 HIG—
——0Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.1dCVE-2026-812838.8 HIG—
——0Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.1d