CVE-2026-84645

In Jenkins versions weekly ≤ 2.579 and LTS ≤ 2.568.2 , a deserialization vulnerability (SECURITY-3972) allows for remote code execution (RCE) . The root cause lies in the XStream stack (hudson.util.XStream2 / RobustReflectionConverter), where PersistenceRoot types can be deserialized as nested fi...