CVE 2026 53435

nvd.nist.gov • June 17, 2026

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Jenkins Exploited in the Wild A critical remote code execution (RCE) vulnerability, CVE-2026-53435, has been identified in Jenkins, affecting versions 2.567 and earlier, including LTS 2.555.2 and earlier. This flaw allows attackers to exploit insecure deserialization during the processing of an attacker-controlled config.xml file, enabling them to impersonate users and execute arbitrary code. The vulnerability is particularly dangerous as it can be exploited by unauthenticated or low-privileged users, posing a significant risk to organizations that utilize Jenkins for continuous integration and deployment. Active exploitation of this vulnerability has been confirmed, prompting urgent advisories for immediate patching. Organizations are advised to enhance their monitoring capabilities to detect any suspicious activity related to this vulnerability. The Centre for Cybersecurity Belgium has emphasized the need for swift action to mitigate potential impacts. 2 sources 76

Extracted Entities

CVE 2026 53435

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)