Jenkins 2.588 and LTS 2.580.2 Fix 15 Vulnerabilities
Tech GuruQuick Answer
The October 28 Jenkins advisory fixes 15 vulnerabilities in core. Inventory controllers and permissions, update weekly installations to 2.588 or LTS to 2.580.2, validate agents, jobs and plugins, review exposed controllers where warranted, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Jenkins controllers, exact weekly or LTS versions, internet and reverse-proxy exposure, authentication realms, Overall/Read and administrative users, agents, plugins, jobs, backups, owners, and maintenance windows. Confirm controller version, permissions and affected feature paths for each finding; do not infer that agents or plugins alone are vulnerable, and do not equate a high severity rating with confirmed exploitation. Update Jenkins weekly to 2.588 or Jenkins LTS to 2.580.2 through the supported process, protect controller access during rollout, and update compatible plugins after review. Confirm the running core version, test login, authorization, agents, builds, credentials, configuration saves, file browsing and backup restore, review controller logs where exposure warrants it, and retain package and change evidence.
Last verified: 2026-10-29 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Jenkins core weekly and LTS releases |
|---|---|
| Advisory | Jenkins Security Advisory 2026-10-28 |
| CVEs | CVE-2026-117612, CVE-2026-117613, CVE-2026-117614, CVE-2026-117615, CVE-2026-117616, CVE-2026-117617, CVE-2026-117618, CVE-2026-117619, CVE-2026-117620, CVE-2026-117621, CVE-2026-117622, CVE-2026-117623, CVE-2026-117624, CVE-2026-117625, CVE-2026-117626 |
| Authoritative release date | 2026-10-28 16:48:29.130 UTC |
| Authority revision date | 2026-10-28 16:48:37.200 UTC |
| Affected versions | Jenkins weekly through 2.587 and Jenkins LTS through 2.580.1, with issue-specific permissions and features described in the advisory. |
| Fixed version | Jenkins weekly 2.588 or Jenkins LTS 2.580.2 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Medium to High |
| Exploitation status | Jenkins does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Jenkins fixed 15 core vulnerabilities involving XStream deserialization, authorization and permission checks, user and configuration data, file browsing, proxy information, and related administrative paths.
What To Validate Now
- Inventory. Inventory Jenkins controllers, exact weekly or LTS versions, internet and reverse-proxy exposure, authentication realms, Overall/Read and administrative users, agents, plugins, jobs, backups, owners, and maintenance windows.
- Establish applicability. Confirm controller version, permissions and affected feature paths for each finding; do not infer that agents or plugins alone are vulnerable, and do not equate a high severity rating with confirmed exploitation.
- Remediate. Update Jenkins weekly to 2.588 or Jenkins LTS to 2.580.2 through the supported process, protect controller access during rollout, and update compatible plugins after review.
- Validate. Confirm the running core version, test login, authorization, agents, builds, credentials, configuration saves, file browsing and backup restore, review controller logs where exposure warrants it, and retain package and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Core updates can expose plugin compatibility or serialization problems. Back up the controller, stage the update, protect credentials and configuration evidence, and avoid restoring an older vulnerable controller after validation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
