8.8 High
CVE-2026-53435
Jenkins Project Jenkins vulnerability
Jenkins ProjectJenkins
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 23 Oct
2.2%probability of exploitation in the next 30 days
Higher than 82% of scored CVEs
SeverityCVSS
8.8High
Description NVD
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
Coverage 2 articles · 1 outlet
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 11 Jun · 04:22 UTC | SecurityOnline | Jenkins advisory flags critical deserialization flaw and bugs |
| Mon 15 Jun · 10:50 UTC | SecurityOnline | Attackers exploit Jenkins flaw to execute code through config.xml |
- Attackers exploit Jenkins flaw to execute code through config.xmlSecurityOnline
- Jenkins advisory flags critical deserialization flaw and bugsSecurityOnline · first in our coverage