ACTIVELY EXPLOITED
CVE-2017-1000353: Jenkins Remote Code Execution Vulnerability
| Vendor | Jenkins |
|---|---|
| Product | Jenkins |
| Actively exploited | Yes |
| Added to CISA KEV | 2 Oct 2025 |
| CISA federal deadline | 23 Oct 2025 |
Required action (CISA's text)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
SOURCES
Other Jenkins flaws
- CVE-2024-23897: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
- CVE-2015-5317: Jenkins User Interface (UI) Information Disclosure Vulnerability
- CVE-2019-1003029: Jenkins Script Security Plugin Sandbox Bypass Vulnerability
- CVE-2019-1003030: Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
- CVE-2018-1000861: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.