CVE-2026-84675: Command Injection
Published Sep 2, 2026
·Updated
OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.
Affected Software
1 affected component
Jenkins TICS Plugin<=2025.1.1
Event History
Sep 2, 2026
CVE Published
via MITRE·03:40 PM
Data Sourced
via MITRE·03:40 PM
Description
Data Sourced
via NVD·04:17 PM
Description
Frequently Asked Questions
1
Who is exposed to exploitation?
Jenkins installations using TICS Plugin version 2025.1.1 or earlier are exposed when an attacker can control build environment variable values. The arbitrary commands run on the agent that executes the affected build.
2
What level of access does an attacker need?
The attacker needs the ability to control environment variable values for a build. The provided information does not establish that unauthenticated or network-only access is sufficient.
3
What can an attacker do if exploitation succeeds?
An attacker can execute arbitrary operating-system commands on the Jenkins agent running the build.