- Description
- In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
- Source
- jenkinsci-cert@googlegroups.com
- NVD status
- Modified
- Products
- jenkins
CVSS 3.1
- Type
- Secondary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- Hype score
- Not currently trending
🚨 August Linux Patch Wednesday: record 3,060 vulns (+52%); 3 exploited in the wild - Jenkins RCE CVE-2026-53435, WordPress CodeInj CVE-2026-60137, SPIP RCE CVE-2026-77647 + 127 with public exploits. #LinuxPatchWednesday #Linux #Vulristics ➡️ https://t.co/pGlcEtfrmg https:/
@leonov_av
28 Aug 2026
67 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2026-53435: CVE: CVE-2026-53435 PT ID: PT-2026-48420 Vendor: Jenkins Project Product: Jenkins CVSS: 8.8 Credits: n/a Description: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in…
@lyrie_ai
11 Jul 2026
28 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
If you’re looking to reduce your attack surface without the weekend emergency maintenance, start by simplifying your configurations. Here's how we're mitigating CVE-2026-46333, CVE-2026-49160, and CVE-2026-53435. https://t.co/vafkiqM0jA
@vicariusltd
2 Jul 2026
61 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Jenkinsのリモートコード実行（RCE）脆弱性CVE-2026-53435が現在悪用されています Jenkins RCE Vulnerability CVE-2026-53435 Now Under Active Exploitation #DailyCyberSecurity (Jun 15) https://t.co/IxfF69HOHd
@foxbook
16 Jun 2026
200 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE: CVE-2026-53435 PT ID: PT-2026-48420 Vendor: Jenkins Project Product: Jenkins CVSS: 8.8 Credits: n/a Description: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or
@ptdbugs
15 Jun 2026
23 Impressions
1 Retweet
1 Like
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*",
"matchCriteriaId": "648B5148-FE3B-464A-8963-DCF7ACEF84E5",
"versionEndExcluding": "2.555.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*",
"matchCriteriaId": "356A970F-6576-49B6-8EBA-E9770ED190A7",
"versionEndExcluding": "2.568",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]