CVE-2022-36900: Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent m...

Security readout for executives and security teams

This Jenkins plugin flaw can let someone who already controls a Jenkins agent process read Java system properties from the Jenkins environment. That may expose configuration details or sensitive values if they are stored in system properties. The public sources do not show active exploitation or a fixed version. Exposure is limited to Jenkins environments using Compuware zAdviser API Plugin 1.0.3 or earlier, especially where agent processes are less trusted or shared. Treat this as a targeted Jenkins hardening issue, not an internet-wide emergency. Prioritize if affected Jenkins agents are shared, externally influenced, or used by lower-trust teams. Mitigation focus: Inventory Jenkins instances for Compuware zAdviser API Plugin usage and version.; Check Jenkins advisory and plugin guidance for fixed versions or vendor recommendations.; Disable or remove the plugin if it is not operationally required..

Prepared

Jun 2, 2026, 02:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.