CVE-2026-84652

score

0.3

cvss

7.3

epss

0.4%

published

2026-09-02

kev added

—

first seen

2026-10-21

Jenkins <= 2.579 and LTS <= 2.568.2 contains a session fixation vulnerability caused by lack of session rotation on authentication via "remember me" cookie, letting attackers with same-site content access victim's session, exploit requires attacker to serve content on same site.