CVE-2026-84677: Jenkins Project Jenkins Update-CENTER2

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.

Affected products

• Jenkins Project Jenkins Update-CENTER2: up to and including 3.18.3

Published 2026-09-02. Last modified 2026-09-03.