Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 2.57, 2.46.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Jenkins, the open-source automation server, is affected, and an attacker without any login could run arbitrary code on the server. The flaw lets crafted serialized Java data bypass the existing protection list through the Jenkins command-line interface.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
- org.jenkins-ci.main:jenkins-coreMaven
From 2.50 · fixed in 2.57
- org.jenkins-ci.main:jenkins-coreMaven
fixed in 2.46.2
References 5
Exploit-DB
securityfocus.com
oracle.com
jenkins.io
packetstormsecurity.com
Questions about CVE-2017-1000353
What does this mean?
Jenkins has a flaw in its remoting-based command-line interface that lets an unauthenticated remote attacker run code on the Jenkins server. No login is needed to reach the bug.Source: jenkins.io
Am I affected, and how do I check?
Jenkins main line releases up to and including 2.56, and LTS releases up to and including 2.46.1, are affected when the remoting-based CLI is in use. To check, look at the Jenkins version shown at the bottom of the web interface, and confirm whether the remoting-based CLI is enabled in your setup.Source: jenkins.io
What should I do about it?
Upgrade Jenkins main line to 2.57 or later. The fix is also in the 2.46.2 LTS release line. If you cannot upgrade right away, disable the remoting-based CLI and use the HTTP or SSH CLI instead.Source: jenkins.io
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-10-02, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data