In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9096f6e4-3a2f-4d16-89fb-f909aa0a7760 advisory.

    Jenkins Security Advisory 2026-08-05:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2...
    (CVE-2026-70426)

  - Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting...
    (CVE-2026-70428)

  - A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with...
    (CVE-2026-70435)

  - Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check ...
    (CVE-2026-70436)

  - Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a...
    (CVE-2026-70437)

  - Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing...
    (CVE-2026-70439)

  - Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate...
    (CVE-2026-70443)

  - A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier...
    (CVE-2026-70444)

  - Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with...
    (CVE-2026-70447)

  - Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML...
    (CVE-2026-70448)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
332974	FreeBSD : jenkins -- multiple vulnerabilities (9096f6e4-3a2f-4d16-89fb-f909aa0a7760)	Nessus	FreeBSD Local Security Checks	critical
332686	Jenkins plugins Multiple Vulnerabilities (2026-08-05)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2026-70426

critical

Tenable Plugins

critical

critical