CVE-2026-9674
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds.
Risk Assessment
An attacker can force resumption of failed builds without the user's knowledge, potentially leading to unauthorized actions in the CI/CD environment.
Recommendation
Update Jenkins Multijob Plugin to a version newer than 662.vd2e0001f6b_b_d.
Other vulnerabilities in Jenkins Multijob Plugin
See all- CVE-2026-70432High
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.
- CVE-2026-70431High
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
Original NVD description (English source)
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS