PT-2026-20433 · Jenkins+1 · Jenkins+1

Muhammed Niazy + 1 · Published 2026-02-18 · Updated 2026-05-29 · CVE-2026-27099

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.483 through 2.550 Jenkins LTS versions 2.492.1 through 2.541.1

Description The application does not properly sanitize user-supplied data within the description field of the "Mark temporarily offline" functionality. This can lead to a stored cross-site scripting (XSS) condition. Successful exploitation requires an attacker to have Agent/Configure or Agent/Disconnect permissions. The vulnerability involves the lack of escaping of user input, potentially allowing malicious scripts to be stored and executed within the application.

Recommendations Update Jenkins to a version greater than 2.550. Update Jenkins LTS to a version greater than 2.541.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-05584

BIT-JENKINS-2026-27099

CVE-2026-27099

GHSA-85H6-5M3V-GX37

Affected Products

Jenkins

Red Os

References · 25

• https://jenkins.io/security/advisory/2026-02-18/#SECURITY-3669 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2026-27099 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05584 · Security Note
• https://osv.dev/vulnerability/GHSA-85h6-5m3v-gx37 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27099 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27099 · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/578c028e2cdfdc9e124d0ca389a80bb2bd231ab2 · Note
• https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.551 · Note
• https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.541.2 · Note
• https://github.com/jenkinsci/jenkins · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-jenkins-cve-2026-27099-7.3 · Note
• https://twitter.com/dailytechonx/status/2025250426900152408 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2024484677021503721 · Twitter Post
• https://twitter.com/ThreatSynop/status/2024838583153029499 · Twitter Post
• https://twitter.com/autumn_good_35/status/2024419298182385834 · Twitter Post