CVE-2026-53435: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbit…

Is it exploited?

Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of 28 Oct 2026. If CISA adds it, this page shows it as known exploited.

How likely is exploitation in the next 30 days?

53.1%

EPSS score, percentile 99 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

8.8 High

CVSS v3.1 base score, from CISA's enrichment of the record

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (1)

Which versions are affected?

Unaffected 2.568; 2.555.3

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

Advisories and patches

• Jenkins Security Advisory 2026-06-10 (Vendor advisory)

Affected products and versions

As listed in the CVE record.

Versions not listed are: affected.

Versions the record lists as unaffected: 2.568, 2.555.3.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Con…

Summary: CVE record, as of 28 Oct 2026.

• CISA has not added CVE-2026-53435 to its Known Exploited Vulnerabilities (KEV) catalog, as of 28 Oct 2026.
• The CVE record was published on 10 Jun 2026.
• The CVE record carries a CVSS v3.1 base score of 8.8 (High), taken from CISA's enrichment of the record.
• FIRST's EPSS model puts the probability of exploitation in the next 30 days at 53.1% (percentile 99), as of 28 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
• CISA's SSVC assessment in the CVE record: exploitation none, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

• CWE-502: Deserialization of Untrusted Data

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

Known exploited Jenkins vulnerabilities

• CVE-2017-1000353: Jenkins Remote Code Execution Vulnerability (added 2 Oct 2025)
• CVE-2024-23897: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability (added 19 Aug 2024)
• CVE-2015-5317: Jenkins User Interface (UI) Information Disclosure Vulnerability (added 12 May 2023)
• CVE-2019-1003029: Jenkins Script Security Plugin Sandbox Bypass Vulnerability (added 25 Apr 2022)
• CVE-2019-1003030: Jenkins Matrix Project Plugin Remote Code Execution Vulnerability (added 25 Mar 2022)