CVE-2026-53435
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, an attacker can deserialize arbitrary types from Jenkins core or plugins via a crafted `config.xml` submission. This allows handling HTTP requests, impersonating any user, executing arbitrary code via the Script Console, or reading arbitrary files from the Jenkins controller.
Risk Assessment
The risk to the organization is critical – an attacker can gain full control over the Jenkins server, steal sensitive data, execute malicious code, and impersonate authorized users, potentially compromising the entire CI/CD pipeline.
Recommendation
Immediately upgrade Jenkins to version 2.568 or later (LTS 2.555.3 or later). If upgrading is not possible, restrict access to the Jenkins interface to trusted networks and users, and monitor for unusual `config.xml` submissions.
Original NVD description (English source)
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.