In Remoting 3384.v60d89463d9e0 and earlier

CVE-2026-70426 is a deserialization filter bypass in the Jenkins Remoting library (≤ 3384.v60d89463d9e0, except backport 3355.3357.v931d3c992987), bundled in Jenkins weekly ≤ 2.575 and LTS ≤ 2.568.1. The JEP-200 class filter — Jenkins's primary defense against Java deserialization attacks traversing the controller↔agent channel — is not applied on a fallback code path in the Remoting implementation. An attacker who controls an agent process, runs code on an agent node, or holds Agent/Connect permission can craft serialized payloads using classes on the Jenkins core classpath, bypass the filter, and achieve remote code execution on the Jenkins controller.

The vendor rates this CRITICAL at 9.0, and for once the label fits. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C) slightly overstates the 'no privileges required' angle — you need agent-level access or Agent/Connect permission — but AC:H correctly reflects the gadget-chain complexity, and S:C is dead-on because compromising the controller means you own every pipeline, every credential store, and every artifact that flows through the system. The scope change to supply-chain impact justifies the CRITICAL tag without inflating it further.

Why this verdict

• Supply-chain blast radius is fleet-scale by design. Jenkins controllers hold pipeline definitions, stored credentials (cloud keys, SSH keys, deploy tokens), and artifact-signing material. Controller RCE converts a single-host compromise into an organization-wide supply-chain event.
• Role multiplier: CI/CD canonical component. 100% of Jenkins installations are CI/CD systems — this is not a niche deployment role. The affected component (Remoting) is the foundational communication layer between controller and every agent, making it the highest-leverage attack surface in the Jenkins architecture.
• Historical precedent for rapid weaponization. Jenkins deserialization vulnerabilities have a strong track record of fast PoC development and in-the-wild exploitation. CVE-2026-53435 (disclosed June 2026) was weaponized within days and is now actively exploited. CVE-2024-23897 followed the same pattern.
• 75,000+ internet-facing instances per Shodan, plus a massive internal deployment footprint. Even with AC:H friction from gadget-chain complexity, the target population is enormous.

Why not higher?

The score is already 9.0 CRITICAL, which is the vendor's rating. While one advisory source listed 9.9, the AC:H (gadget-chain complexity) and the practical requirement for agent-level access provide legitimate friction that keeps this from a perfect 10.0. There is no evidence of active exploitation or public PoC yet, so no urgency multiplier pushes this above 9.0 today.

Why not lower?

Downgrading below CRITICAL is blocked by the high-value-role floor rule: Jenkins is a canonical CI/CD platform, 100% of installs occupy the high-value role, and the documented chain (agent access → deser bypass → controller RCE → supply-chain pivot) succeeds in that role with fleet-scale / supply-chain-scale blast radius. The AC:H friction from gadget-chain complexity is real but does not overcome the role-multiplier floor — Jenkins deser gadgets have been found repeatedly in the core classpath (ysoserial, prior CVEs), and the restriction to core-only classes narrows but does not eliminate the gadget surface.

1. Apply the jenkinsci-cert SECURITY-3911-3930 workaround plugin immediately — The Jenkins Security Team published a temporary workaround at https://github.com/jenkinsci-cert/SECURITY-3911-3930/ that patches the fallback deserialization path without a full upgrade. Deploy within the noisgate CRITICAL mitigation SLA of 3 days.
2. Audit and restrict Agent/Connect permissions — Review the Jenkins authorization matrix and remove Agent/Connect permission from all users and roles that do not absolutely require it. This directly reduces the attacker population for this CVE.
3. Enforce agent-to-controller access control — Enable and audit the Agent → Controller Access Control feature (jenkins.security.s2m.AdminWhitelistRule). This limits which Remoting commands agents can invoke on the controller, reducing the deserialization attack surface.
4. Network-segment the controller from untrusted networks — Ensure the Jenkins controller is not directly internet-facing. Place it behind a reverse proxy with authentication. Restrict Remoting ports (TCP 50000/JNLP) to known agent subnets only via firewall rules.
5. Rotate all credentials stored in Jenkins — Assume that if an attacker has already exploited this (pre-disclosure window), stored credentials are compromised. Rotate cloud keys, SSH keys, API tokens, and deployment credentials stored in Jenkins credential stores.
6. Deploy EDR/RASP on the controller host — Runtime detection of anomalous process spawning from the Jenkins JVM (java spawning bash, cmd, powershell, curl, wget) provides a backstop if exploitation occurs before patching.

Run this script on each Jenkins controller host (not agents). It checks the installed Jenkins version and Remoting library version against the patched thresholds. Requires read access to the Jenkins WAR/installation directory. Example: sudo bash check_cve_2026_70426.sh /usr/share/jenkins or bash check_cve_2026_70426.sh /opt/jenkins

#!/usr/bin/env bash
# check_cve_2026_70426.sh — Detect CVE-2026-70426 (Jenkins Remoting JEP-200 bypass)
# Usage: bash check_cve_2026_70426.sh [JENKINS_HOME_OR_WAR_DIR]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

JENKINS_DIR="${1:-/usr/share/jenkins}"
RESULT="UNKNOWN"

# Try to get Jenkins version from the WAR manifest or version file
get_jenkins_version() {
  local ver=""
  # Check for version.txt or similar
  for f in "$JENKINS_DIR/jenkins.war" "$JENKINS_DIR/war/META-INF/MANIFEST.MF" "/var/lib/jenkins/config.xml"; do
    if [[ -f "$f" ]]; then
      if [[ "$f" == *.war ]]; then
        ver=$(unzip -p "$f" META-INF/MANIFEST.MF 2>/dev/null | grep -i 'Jenkins-Version' | head -1 | cut -d: -f2 | tr -d ' \r')
      elif [[ "$f" == *MANIFEST.MF ]]; then
        ver=$(grep -i 'Jenkins-Version' "$f" 2>/dev/null | head -1 | cut -d: -f2 | tr -d ' \r')
      fi
    fi
  done
  # Fallback: query the running instance
  if [[ -z "$ver" ]]; then
    ver=$(curl -sk -o /dev/null -w '' "http://localhost:8080" 2>/dev/null && \
          curl -sk "http://localhost:8080" 2>/dev/null | grep -oP 'Jenkins-Version[":]\s*\K[0-9.]+' | head -1 || true)
  fi
  if [[ -z "$ver" ]]; then
    ver=$(curl -sk -I "http://localhost:8080" 2>/dev/null | grep -i 'X-Jenkins:' | awk '{print $2}' | tr -d '\r' || true)
  fi
  echo "$ver"
}

version_compare() {
  # Returns 0 if $1 >= $2, 1 otherwise
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

VERSION=$(get_jenkins_version)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not determine Jenkins version. Check JENKINS_DIR path: $JENKINS_DIR"
  exit 2
fi

echo "Detected Jenkins version: $VERSION"

# Check if this is an LTS version (x.y.z format)
if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]]; then
  echo "Detected LTS release."
  if version_compare "$VERSION" "2.568.2"; then
    RESULT="PATCHED"
    echo "PATCHED — Jenkins LTS $VERSION >= 2.568.2. CVE-2026-70426 is remediated."
  else
    RESULT="VULNERABLE"
    echo "VULNERABLE — Jenkins LTS $VERSION < 2.568.2. Affected by CVE-2026-70426."
  fi
else
  echo "Detected weekly release."
  if version_compare "$VERSION" "2.576"; then
    RESULT="PATCHED"
    echo "PATCHED — Jenkins weekly $VERSION >= 2.576. CVE-2026-70426 is remediated."
  else
    RESULT="VULNERABLE"
    echo "VULNERABLE — Jenkins weekly $VERSION < 2.576. Affected by CVE-2026-70426."
  fi
fi

if [[ "$RESULT" == "VULNERABLE" ]]; then
  echo ""
  echo "ACTION: Upgrade to Jenkins 2.576+ (weekly) or 2.568.2+ (LTS)."
  echo "WORKAROUND: Install plugin from https://github.com/jenkinsci-cert/SECURITY-3911-3930/"
  exit 1
elif [[ "$RESULT" == "PATCHED" ]]; then
  exit 0
else
  exit 2
fi

Sources

1. Jenkins Security Advisory 2026-08-05
2. CVE-2026-70426 — THREATINT
3. Jenkins CERT Workaround — SECURITY-3911-3930
4. Canadian Centre for Cyber Security — Jenkins Advisory AV26-142
5. Foresiet — CVE-2026-53435 Jenkins Controller Takeover Analysis
6. Wiz — Jenkins Threat Risk Insights
7. Shodan Jenkins Exposure Analysis (2026)