CVE-2026-84675

HighCVSS 7.4/10Last modified Sep 3, 2026

Description

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Jenkins Project	Jenkins TICS Plugin	<= 2025.1.1

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3987

Timeline

Published: Sep 2, 2026
Last modified: Sep 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-846764.3Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller wh CVE-2026-846775.4Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugi CVE-2026-84688.2Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumu CVE-2026-846827.7A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attack CVE-2026-846838.7A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and CVE-2026-846856.5The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating CVE-2026-84698.2Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-servi CVE-2026-846918.7A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4 CVE-2026-846948.8Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authen CVE-2026-846958.7BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 CVE-2026-846968.2Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent CVE-2026-846975.3Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IP