Log in Start free

Actively exploited · Published Jan 29, 2018 · Assigned by mitre

CVE-2017-1000353

Critical 9.8 Exploited

In plain English

A critical-severity unsafe deserialization in Jenkins from Jenkins. Attackers are actively exploiting it in the wild (listed by CISA on October 2, 2025). The chance it is exploited in the next 30 days is estimated at 99.7% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)99.7%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Oct 2, 2025
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Oct 23, 2025.

Official description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.jenkins-ci.main:jenkins-core2.57GHSA-26wc-3wqp-g3rp
Mavenorg.jenkins-ci.main:jenkins-core2.46.2GHSA-26wc-3wqp-g3rp

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References