# CVE-2016-9299: Jenkins remoting module Java deserialization RCE via LDAP query

Source: https://junglewise.ai/threats/cve-2016-9299-jenkins-remoting-module-java-deserialization-rce-via-ldap-query  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-12. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-9299 · Severity: critical · CVSS 9.8 · Published 2017-01-12

Jenkins is a popular automation server used by software teams to build and deploy code. A critical security flaw in its communication module allows an unauthenticated attacker to take full control of the server. By sending a specially crafted message, an attacker can force the server to execute malicious code, potentially leading to data theft or complete system compromise.

Technologies: [Jenkins](https://junglewise.ai/threats/technologies/jenkins), [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2016-9299 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-9299 being exploited in the wild.

**How severe is CVE-2016-9299?** Critical severity, with a CVSS score of 9.8, published 12 January 2017.

**Which products and versions are affected?** Jenkins before 2.32, LTS before 2.19.3; Jenkins Remoting before 2.62.3; org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=2.20,fixed=2.32.

**Is there a fix for CVE-2016-9299?** Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-9299 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-9299?** Check whether you run Jenkins, Jenkins Remoting or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.32 or later

  ```sh
  # set org.jenkins-ci.main:jenkins-core to 2.32 in your pom.xml or build.gradle
  ```


## Technical details

A remote code execution (RCE) vulnerability exists in the Jenkins remoting module due to unsafe Java deserialization. An unauthenticated attacker can send a crafted serialized Java object to the Jenkins CLI or remoting port. This object triggers an LDAP query to an attacker-controlled third-party server, which then returns a malicious payload that bypasses existing protection mechanisms to execute arbitrary code on the Jenkins master. The issue is tracked by the vendor as SECURITY-360 and was patched in Jenkins 2.32, LTS 2.19.3, and remoting module 2.62.3.

## Affected products

- Jenkins Jenkins before 2.32, LTS before 2.19.3
- Jenkins remoting module before 2.62.3

## Identifiers

- CVE-2016-9299
- GHSA-2x9h-h3c4-wqqh

## Timeline

- 2016-11-13: disclosed: Vulnerability disclosed to oss-security mailing list
- 2016-11-14: other: CVE-2016-9299 assigned
- 2016-11-16: patched: Jenkins security advisory and fixes released
- 2017-01-12: advisory: NVD publication date

## References

- [http://www.openwall.com/lists/oss-security/2016/11/12/4](http://www.openwall.com/lists/oss-security/2016/11/12/4)
- [http://www.openwall.com/lists/oss-security/2016/11/14/9](http://www.openwall.com/lists/oss-security/2016/11/14/9)
- [http://www.securityfocus.com/bid/94281](http://www.securityfocus.com/bid/94281)
- [http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition](http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition)
- [https://groups.google.com/forum/](https://groups.google.com/forum/)
- [https://groups.google.com/forum/](https://groups.google.com/forum/)
- [https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6/)

## Related threats

- [Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly)
- [Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2)
- [Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents)