EUVD-2026-53569
GHSA-v269-8r2r-vj93
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Network channel exploitation requires Agent/Connect permission (PR:L); scope changes from agent to controller (S:C); full code execution yields C:H/I:H/A:H.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Remote code execution on the Jenkins controller is achievable by attackers holding Agent/Connect permission via a JEP-200 deserialization filter bypass in the Remoting library (agent.jar/remoting.jar). Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, include a Remoting version (3384.v60d89463d9e0 and earlier, except the backport 3355.3357.v931d3c992987) that fails to apply the JEP-200 class filter to a fallback deserialization code path, allowing crafted serialized Java objects to reach classes on the Jenkins core classpath that are not blocked by the pre-JEP-200 denylist. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of two conditions: (1) the attacker holds the Agent/Connect permission on the Jenkins controller, which grants the ability to register and operate agent processes; or (2) the attacker has already compromised an existing legitimate agent process (e.g., via a separate vulnerability or supply-chain attack on build tooling). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No vendor-provided CVSS vector accompanies this CVE in the available data, so risk signals are inferred from the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds Agent/Connect permission - for example, a contractor with CI access or a compromised build service account - connects a malicious agent to the Jenkins controller and transmits a crafted serialized Java object referencing a gadget class that exists on the Jenkins core classpath but is absent from the pre-JEP-200 denylist. Because the JEP-200 filter is not applied on the fallback deserialization path, the object is instantiated on the controller JVM, resulting in arbitrary code execution under the OS user running Jenkins. … |
| Remediation | Upgrade Jenkins to 2.576 (weekly) or Jenkins LTS 2.568.2, which include the fixed Remoting version that correctly applies the JEP-200 class filter across all deserialization code paths including the previously unprotected fallback path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Jenkins instances running versions 2.575 and earlier (LTS 2.568.1 and earlier) and audit which agents or systems hold Agent/Connect permissions-immediately restrict these to only essential, authenticated, trusted agents, documenting business justification for each. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today