NexaPulse
Subscribe
8.8highHigh

CVE-2026-53435

Jenkins Jenkins

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, an ordinary user account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
8.8 (v3.1)
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Assigned by
jenkinsci-cert@googlegroups.com

Dates

Published
2026-06-10
Last modified
2026-08-27
Sources
NVD

Affected products

  • Jenkins Jenkins- 2.555.3, - 2.568

As listed in the NVD configuration data. Not a statement about your estate.

References