CVE-2026-70426

Name of the Vulnerable Software and Affected Versions Remoting versions prior to 3384.v60d89463d9e0 (excluding version 3355.3357.v931d3c992987) Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2

Description The JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation. This allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath. JEP-200 is a Java Enhancement Proposal that introduces a mechanism to filter incoming serialized data to prevent the deserialization of unauthorized classes.

Recommendations Update Remoting to a version newer than 3384.v60d89463d9e0, ensuring version 3355.3357.v931d3c992987 is not used if it was previously considered a fix. Update Jenkins to version 2.576 or later. Update Jenkins LTS to version 2.568.2 or later.