Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 428e782a-0e92-11f1-a9b1-0cc47ada5f32 advisory.

    Jenkins Security Advisory:
    Stored XSS vulnerability in node offline cause description     Build information disclosure vulnerability through Run Parameter

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape
    the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored
    cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect
    permission. (CVE-2026-27099)

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.541.2 or Jenkins weekly prior to 2.551. It is, therefore, affected by multiple vulnerabilities:

  - Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape     the user-provided description of the Mark temporarily offline offline cause, resulting in a stored     cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect     permission. (CVE-2026-27099)

  - Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the     user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure     permission to obtain information about the existence of jobs, the existence of builds, and if a specified     build exists, its display name. (CVE-2026-27100)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
299732	FreeBSD : jenkins -- multiple vulnerabilities (428e782a-0e92-11f1-a9b1-0cc47ada5f32)	Nessus	FreeBSD Local Security Checks	high
437902	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-85h6-5m3v-gx37)	Tenable Cloud Security	SCA Checks	high
437902	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-85h6-5m3v-gx37)	Tenable Self-Hosted Container Security	SCA Checks	high
299406	Jenkins LTS < 2.541.2 / Jenkins weekly < 2.551 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2026-27099

high

Tenable Plugins

high

high

high

high