What is the CVSS score of CVE-2026-53435?

CVE-2026-53435 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Jenkins are affected by CVE-2026-53435?

Jenkins automation server versions 2.567 and earlier contain an unsafe deserialization vulnerability (CVE-2026-53435, CVSS 8.8) allowing authenticated users to execute arbitrary code on Jenkins…. A patch is available.

How to fix or mitigate CVE-2026-53435?

Within 24 hours: Identify all Jenkins instances running version 2.567 or earlier (LTS 2.555.2 or earlier) and restrict configuration file (config.xml) submission permissions to trusted administrators only. Within 7 days: Implement network-level access controls limiting Jenkins controller API and web interface to authorized networks, enable Jenkins audit logging, and review all configuration modification history. Within 30 days: Monitor vendor advisories for patched releases; establish upgrade and testing plan to apply patches immediately upon availability, or formalize interim compensating controls if upgrade timeline extends beyond risk tolerance.

Jenkins CVE-2026-53435

EUVD-2026-36019 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-10 jenkins

GHSA-g2xq-2v27-4rh3

RCE Deserialization Jenkins

8.8

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 16:28 vuln.today

CVSS changed

Jun 10, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 10, 2026 - 13:05 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 10, 2026 - 13:05 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.jenkins-ci.main:jenkins-core (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.556.

DescriptionCVE.org

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

AnalysisAI

Authenticated remote code execution in Jenkins 2.567 and earlier (LTS 2.555.2 and earlier) allows attackers with permission to submit config.xml to trigger deserialization of arbitrary core or plugin types that subsequently handle HTTP requests, enabling user impersonation, Script Console abuse, and arbitrary file reads from the controller. The flaw is tracked as a CWE-502 unsafe deserialization issue with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, but the vendor (Jenkins project) has issued a coordinated advisory and patched releases.

Technical ContextAI

Jenkins is a widely deployed Java-based automation server whose job, view, and credential definitions are persisted as XML and reconstituted via XStream/Java object deserialization. CWE-502 (Deserialization of Untrusted Data) applies here because Jenkins core and plugins expose types that, when materialized from an attacker-controlled config.xml POST, register themselves into Stapler's HTTP request handling pipeline. Once such an object is alive in the controller JVM, it can intercept subsequent HTTP requests and execute logic in the security context of the requesting user, including the admin-only Script Console route, which evaluates arbitrary Groovy with full filesystem and process access. The affected CPE is cpe:2.3:a:jenkins_project:jenkins:*:*:*:*:*:*:*:* covering both the weekly (≤2.567) and LTS (≤2.555.2) lines.

RemediationAI

Vendor-released patch: upgrade to Jenkins weekly 2.568 or Jenkins LTS 2.555.3 as published in the 2026-06-10 advisory at https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707. Until the upgrade is applied, restrict who can submit config.xml by tightening the authorization strategy so that only highly trusted accounts hold Item/Configure, Job/Configure, and User/Configure permissions, and disable any anonymous or authenticated-read-all matrix entries that grant configure-style rights; this reduces the attack surface but will block legitimate self-service job and user edits. Place the controller behind an authenticating reverse proxy or VPN and block direct internet access to /job/*/config.xml, /user/*/config.xml, and similar POST endpoints, accepting that CLI and API automation against those paths will also be impacted. Audit recent config.xml submissions and Script Console activity for signs of abuse, and rotate credentials stored in Jenkins after patching given the impersonation impact.