CVE-2026-92128

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d

Description The plugin downloads a JAR file from a specified URL twice. It confirms the approval of the first download but loads the classpath entries from the second. This behavior allows attackers who can define classpath entries to execute arbitrary code within the context of the Jenkins controller JVM (Java Virtual Machine), which is the engine that provides the runtime environment to execute Java bytecode.

Recommendations Update Jenkins Script Security Plugin to a version later than 1415.v9a f9b 3a c253d.