CVE-2026-84675: Jenkins TICS Plugin RCE Vulnerability

CVE-2026-84675 Overview

CVE-2026-84675 is an operating system (OS) command injection vulnerability in the Jenkins TICS Plugin version 2025.1.1 and earlier. The flaw allows attackers who can control build environment variable values to execute arbitrary commands on the Jenkins agent running the build. The weakness is classified as [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

The vulnerability affects continuous integration pipelines that invoke the TICS Plugin, exposing agent hosts to unauthorized command execution. Attackers with permission to define or influence build parameters can pivot from Jenkins job configuration into shell command execution on build agents.

Critical Impact
Attackers able to control build environment variables can execute arbitrary OS commands on Jenkins agents, compromising build integrity and enabling lateral movement inside CI/CD infrastructure.

Affected Products

Jenkins TICS Plugin versions 2025.1.1 and earlier
Jenkins controllers and agents running the vulnerable plugin
CI/CD pipelines that invoke TICS analysis steps

Discovery Timeline

2026-09-02 - CVE-2026-84675 published to the National Vulnerability Database (NVD)
2026-09-02 - Jenkins publishes Jenkins Security Advisory #SECURITY-3987
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84675

Vulnerability Analysis

The Jenkins TICS Plugin passes build environment variable values into an OS command invocation without proper neutralization of shell metacharacters. When the plugin executes the TICS analysis binary on an agent, attacker-controlled variable values are concatenated into a command string that the shell interprets.

A user with permission to configure or trigger builds can inject characters such as ;, &&, |, or backticks into an environment variable. The injected payload runs with the privileges of the Jenkins agent process. This grants the attacker code execution on the build node, access to workspace contents, and potential access to credentials cached on the agent.

Root Cause

The root cause is missing input sanitization when the plugin constructs the OS command line from build environment variables. Instead of passing arguments as a discrete argv array to a process API, the plugin appears to interpolate variable values into a shell-interpreted string. This pattern is the canonical [CWE-78] failure mode.

Attack Vector

Exploitation requires an authenticated attacker with the ability to influence build environment variables. This includes users with Job/Configure permission or contributors whose pull requests can set variables through multibranch pipelines. The scope change reflected in the CVSS vector indicates the plugin on the controller can cause command execution on a separate agent.

The vulnerability is described in prose only. Refer to the Jenkins Security Advisory #SECURITY-3987 for authoritative technical details.

Detection Methods for CVE-2026-84675

Indicators of Compromise

Unexpected child processes of the Jenkins agent Java process (java spawning sh, bash, cmd.exe, or powershell.exe) during TICS build steps
Outbound network connections initiated by build agents to unknown hosts during or immediately after a TICS analysis stage
Modifications to files outside the build workspace by the agent user account
Anomalous environment variable values in job configuration containing shell metacharacters such as ;, |, &, or backticks

Detection Strategies

Audit Jenkins job configurations and pipeline definitions for TICS Plugin usage combined with user-controllable environment variables
Correlate Jenkins build logs with agent process telemetry to identify command execution outside expected TICS binaries
Enable Jenkins audit logging and review changes to job configurations, especially environment variable definitions

Monitoring Recommendations

Monitor for process creation events where the parent is a Jenkins agent JVM and the child is a shell interpreter
Alert on new outbound connections from build agents during TICS analysis steps
Track credential store access on agents to detect post-exploitation secret harvesting

How to Mitigate CVE-2026-84675

Immediate Actions Required

Upgrade the Jenkins TICS Plugin to a fixed version as described in Jenkins Security Advisory #SECURITY-3987
Restrict Job/Configure and pipeline-authoring permissions to trusted users only
Review recent builds that used the TICS Plugin for signs of unexpected commands or outbound network activity
Rotate credentials stored on or accessible from Jenkins agents that ran the vulnerable plugin

Patch Information

Jenkins has published fix guidance in Jenkins Security Advisory #SECURITY-3987. Administrators should upgrade the TICS Plugin to the version identified in the advisory. Versions 2025.1.1 and earlier remain vulnerable.

Workarounds

Disable the TICS Plugin on affected Jenkins controllers until the patched version is deployed
Remove or restrict environment variable definitions that can be influenced by lower-privileged users
Isolate Jenkins agents on network segments that block outbound connections to untrusted destinations
Enforce Jenkins agent execution under least-privilege service accounts with restricted filesystem access

bash

# Configuration example: list installed plugin version and disable pending upgrade
jenkins-plugin-cli --list | grep -i tics
# Disable plugin via Jenkins CLI until patched version is available
java -jar jenkins-cli.jar -s https://jenkins.example.com/ disable-plugin tics