CVE-2022-36899: Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agen...

Security readout for executives and security teams

This vulnerability affects Jenkins installations using Compuware ISPW Operations Plugin 1.0.8 or earlier. If an attacker can control a Jenkins agent process, they may retrieve Java system properties from the Jenkins environment. The available sources do not provide CVSS scoring, confirmed exploitation, or complete remediation detail. Exposure is most relevant to Jenkins environments running the affected plugin and using agents that could be compromised, misused, or operated by less-trusted parties. Jenkins controllers without this plugin are not identified as affected in the provided sources. Treat this as a targeted Jenkins hardening issue, not a broad internet-wide emergency. Prioritize environments where Jenkins agents are less trusted or exposed to compromise, because the weakness depends on attacker control of an agent process. Mitigation focus: Inventory Jenkins instances for Compuware ISPW Operations Plugin usage.; If installed, determine whether the version is 1.0.8 or earlier.; Check Jenkins advisory guidance before selecting a fixed version or workaround..

Prepared

Jun 2, 2026, 02:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.