CVE-2017-1000353: Jenkins vulnerability

1. In CISA KEVCISA KEV catalogue2 Oct 2025
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not established: not seen

DescriptionCVE.org

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.

CISA KEV

Listed since 2 Oct 2025 · catalogue entry

Public check

No public nuclei template

Weakness

Deserialization of Untrusted Data · Deserialization and Object Injection

Vendor

Jenkins

Published

January 2018

Band

Exploited in the wild, January 2018

1. 2 Oct 2025
   CISA added it to the KEV catalogue CISA

• NVD entrynvd.nist.gov
• CISA KEV cataloguecisa.gov
• CVE recordcve.org
• Weakness CWE-502cwe.mitre.org
• Exploitexploit-db.com
• securityfocus.com/bid/98056securityfocus.com
• oracle.com/security-alerts/cpuapr2022.htmloracle.com
• jenkins.io/security/advisory/2017-04-26jenkins.io
• packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserializpacketstormsecurity.com