Security Advisory
CVE-2026-84646
4.3
MEDIUM
Vulnerability Description
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.
Published Date
September 2, 2026
Official Source
NIST NVD Advisory