Log in Start free

Vulnerability · Published Jun 10, 2026 · Assigned by jenkins

CVE-2026-53435

High 8.8

In plain English

A high-severity unsafe deserialization in Jenkins from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 51.2% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)51.2%top 1.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.jenkins-ci.main:jenkins-core2.555.3GHSA-g2xq-2v27-4rh3
Mavenorg.jenkins-ci.main:jenkins-core2.568GHSA-g2xq-2v27-4rh3

Affected products (as reported)

VendorProductVersions
Jenkins Project Jenkins see references

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References