CVE-2026-84645 [HIGH] – In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.