ZeroDay Findings
Sign inSign up

Findings

CVE-2017-1000353

Jenkins Remote Code Execution Vulnerability

Published Jan 29, 2018 · updated Jun 16, 2026 · Jenkins Jenkins

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java object to the Jenkins CLI, that would be deserialized using a new , bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 29, 2018 · Catalog

    Detected

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java object to the Jenkins CLI, that would be deserialized using a new , bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding to the

  2. Oct 2, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Oct 23, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java object to the Jenkins CLI, that would be deserialized using a new , bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding to the

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 23, 2025

Affected

  • cpe jenkins/jenkinsversion unspecified
  • cpe oracle/communications cloud native core automated test suite1.9.0
  • vendor Jenkins Jenkinsversion unspecified

Sources

  • CISA KEVCVE-2017-1000353

    Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.

    cisa.gov
  • CVE.orgCVE-2017-1000353

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-1000353

    30-day exploitation probability 99.7%

    first.org
  • Exploit Database41965

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_linux/http/jenkins_cli_deserialization

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2017-1000353

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java object to the Jenkins CLI, that wo

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References