[critical] Jenkins: Remote Code Execution Vulnerability

Thu, 02 Oct 2025 00:00:00 GMT

Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism. Added to CISA KEV on 2025-10-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-02: CISA added CVE-2017-1000353 to the KEV catalog (due 2025-10-23).

CVEs: CVE-2017-1000353

[critical] Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE

Mon, 19 Aug 2024 00:00:00 GMT

Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. Added to the CISA KEV catalog on 2024-08-19. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: Jenkins 2.442, LTS 2.426.3, LTS 2.440.1

Latest updates:

2024-08-19: CISA added CVE-2024-23897 to the KEV catalog (federal deadline 2024-09-09) (source)
2024-01-24: CVE-2024-23897 published (source)
2024-01-24: Jenkins security advisory and fixed releases (source)

CVEs: CVE-2024-23897

pwn.watch: Jenkins incident updates

[critical] Jenkins: Remote Code Execution Vulnerability

[critical] Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE