CVE-2026-84675: Jenkins Project Jenkins Tics Plugin

High severity, CVSS 7.4. EPSS: 1.2% chance of exploitation in the next 30 days.

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.

Affected products

• Jenkins Project Jenkins Tics Plugin: up to and including 2025.1.1

Published 2026-09-02. Last modified 2026-09-03.