Vulnerability intelligence

CVE-2026-53437

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

CVSS Score

4.3

Medium

EPSS — Exploit Probability

0.5%

Riskier than 39% of all CVEs · checked 2026-09-08

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Jun 11, 2026 · latest Jun 11, 2026

Coverage timeline

Jenkins advisory flags critical deserialization flaw and bugs
securityonline.info · Jun 11, 2026

Related CVEs — Jenkins Project

CVE-2026-84645 CVE-2026-70426 CVE-2026-70427 CVE-2026-70428 CVE-2026-57281 CVE-2026-57296 CVE-2026-53435 CVE-2026-53436