CVE-2026-84672

HighCVSS 8.8

Published: 02/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Vulnerability in Jenkins Microsoft Entra ID Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain permissions configured for a privileged group.

Risk Assessment

Risk of privilege escalation in Jenkins by exploiting Entra group name collisions, potentially leading to unauthorized access to sensitive functions and data.

Recommendation

Update Jenkins Microsoft Entra ID Plugin to the latest version. Consider changing configuration to use only unique object IDs for groups, not display names.

Other vulnerabilities in Jenkins Microsoft Entra ID Plugin

CVE-2026-42525Medium
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

Original NVD description (English source)

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS