CVE-2017-1000353
Jenkins Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2025-10-02. Federal due date: 2025-10-23.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CloudBees Jenkins 2.32.1 - Java Deserialization2017-05-05 · dos · java
Impact
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Jenkins | through 2.56 through 2.46.1 |
| Oracle | Communications Cloud Native Core Automated Test Suite | Version 1.9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html
- http://www.securityfocus.com/bid/98056
- https://jenkins.io/security/advisory/2017-04-26/
- https://www.exploit-db.com/exploits/41965/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000353