CVE-2025-64140: Jenkins Azure CLI

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.

Affected products

• Jenkins Azure CLI: up to and including 0.9

Published 2025-10-29. Last modified 2026-10-08.