PT-2026-48420 · Jenkins · Jenkins

Published 2026-06-10 · Updated 2026-06-11 · CVE-2026-53435

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.568 Jenkins LTS versions prior to 2.555.3

Description An issue exists where the software deserializes arbitrary types defined in the core or plugins from an attacker-controlled config.xml submission. This allows attackers to handle HTTP requests, impersonate any user, and send requests on their behalf. This can lead to the execution of arbitrary code via the Script Console or the reading of arbitrary files from the Jenkins controller.

Recommendations Update to version 2.568 or later. Update to LTS version 2.555.3 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-53435

Affected Products

Jenkins

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-53435 · Security Note
• https://jenkins.io/security/advisory/2026-06-10/#SECURITY-3707 · Vendor Advisory
• https://twitter.com/the_yellow_fall/status/2064902609316823404 · Twitter Post
• https://twitter.com/CVEnew/status/2064709797497192512 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2064740984206893371 · Twitter Post