CVE-2026-53435
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards.
This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
CSIRTS triage
- What
- This advisory addresses multiple vulnerabilities in Jenkins Core.
- Who is affected
- Deployments of Jenkins Core are affected.
- Urgency
- Remediation is necessary, but the severity is currently unknown.
- Action
- Update to the latest version of Jenkins Core.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-53435
Get an email if CVE-2026-53435 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Elevated exploitation risk19.0% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 97% of all EPSS-scored CVEs.
Advisory coverage (2)
- highGHSA-g2xq-2v27-4rh3: Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote …ghsa · 2026-06-10
- unknownJenkins Security Advisory 2026-06-10jenkins · 2026-06-10
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-53435)