CVE-2026-53435

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 53.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-10 · updated 2026-10-26
Weakness: CWE-502

Description

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

Affected products

Jenkins: before 2.555.3; before 2.568 — fixed in 2.555.3, 2.568

How to fix

Upgrade to a fixed version: Jenkins 2.555.3, 2.568. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-53435 or the next vulnerability affects your stack