CVE-2026-92124

score

0.4

cvss

8.8

epss

0.6%

published

2026-09-16

kev added

—

first seen

2026-10-21

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier contains a sandbox bypass caused by improper type casting on collections in Groovy scripts, letting attackers with script execution permission run arbitrary code on the Jenkins controller JVM, exploit requires permission to define and run sandboxed scripts.