{"id":"CVE-2026-53435","published":"2026-06-10T13:05:57Z","modified":"2026-09-09T12:05:08Z","title":"In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize…","vendor":"Jenkins Project","product":"Jenkins","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins Project","product":"Jenkins","versions":["all versions"]}],"description":{"text":"In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards.\nThis can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.","provenance":"source","from":"CVE.org"},"summary":{"text":"A deserialization flaw in Jenkins core and its plugins (Jenkins 2.567 and earlier, LTS 2.555.2 and earlier) lets attackers have arbitrary types deserialized from a crafted config.xml submission. An attacker with low-privilege authenticated access, and no user interaction, can use this to impersonate other users and send requests on their behalf, potentially running Script Console code or reading arbitrary files from the Jenkins controller.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:08Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.53131,"percentile":0.9898,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-06-15","exploitedFirstSeen":"2026-06-15","ransomware":false,"evidence":[{"url":"https://x.com/DefusedCyber/status/2066446206285291526","date":"2026-06-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":9,"pulses":[{"name":"Known_Cve | Jun 19, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a33fd81e56054837362ca4a","created":"2026-06-18"},{"name":"Known_Cve | Jun 18, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a32abfd6fc11b7a571269c2","created":"2026-06-17"},{"name":"Known_Cve | Jun 17, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a315a8c1b915c8950938b56","created":"2026-06-16"},{"name":"Known_Cve | Jun 16, 2026","url":"https://otx.alienvault.com/pulse/6a3008e482617bcbc93a12aa","created":"2026-06-15"},{"name":"Known_Cve | Jun 15, 2026","url":"https://otx.alienvault.com/pulse/6a2eb850118f0d1c76bb9210","created":"2026-06-14"},{"name":"Known_Cve | Jun 14, 2026","url":"https://otx.alienvault.com/pulse/6a2d65d31503a930a6e20d59","created":"2026-06-13"},{"name":"Known_Cve | Jun 13, 2026","url":"https://otx.alienvault.com/pulse/6a2c14d3b57c8c251bba6e72","created":"2026-06-12"},{"name":"Known_Cve | Jun 13, 2026","url":"https://otx.alienvault.com/pulse/6a2c14bd794df790b36db07a","created":"2026-06-12"},{"name":"Known_Cve | Jun 12, 2026","url":"https://otx.alienvault.com/pulse/6a2ac336c9d6a9ced493cd07","created":"2026-06-11"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707","tags":["vendor-advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53435","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487539","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53435.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60247","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60249","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60248","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60239","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60251","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60246","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60250","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60252","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60259","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60254","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60256","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":["<2.555.3",">=2.556, <2.568"],"patched":["2.555.3","2.568"],"from":["GHSA-g2xq-2v27-4rh3"],"provenance":"source"}],"advisories":[{"id":"GHSA-g2xq-2v27-4rh3","url":"https://github.com/advisories/GHSA-g2xq-2v27-4rh3","severity":"HIGH","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":["<2.555.3"],"patched":["2.555.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g2xq-2v27-4rh3","url":"https://github.com/advisories/GHSA-g2xq-2v27-4rh3","severity":"HIGH","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":[">=2.556, <2.568"],"patched":["2.568"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-36019","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36019","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-06-12","earliestUrl":"https://github.com/AmesianX/CVE-2026-53435","repos":[{"name":"AmesianX/CVE-2026-53435","url":"https://github.com/AmesianX/CVE-2026-53435","stars":11,"created":"2026-06-12"}]},"first":{"date":"2026-06-12","source":"PoC-in-GitHub","url":"https://github.com/AmesianX/CVE-2026-53435"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-06-10","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-53435","provenance":"source"},{"date":"2026-06-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/AmesianX/CVE-2026-53435","provenance":"source"},{"date":"2026-06-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://x.com/DefusedCyber/status/2066446206285291526","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":73.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 138 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.8,"detail":"percentile 0.9898"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}