Technology · Jenkins
Jenkins vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 24 vulnerabilities in Jenkins: 0 in the last 7 days and 13 in the last 90 days, 5 of them critical and 4 exploited in the wild. The most recent, CVE-2026-84657, was published on 2 September 2026.
- Last 7 days
- 0
- Last 90 days
- 13
- Critical, all time
- 5
- Exploited in the wild
- 4
About Jenkins
An open-source automation server used for continuous integration and continuous delivery.
Latest Jenkins vulnerabilities
- CVE-2026-84657: Jenkins build CLI command authorization bypass via -s flagmediumCVSS 4.2EPSS 0.3%
- CVE-2026-84656: Jenkins missing permission check on build parametersmediumCVSS 4.3EPSS 0.3%
- CVE-2026-84655: Jenkins REST API JSON key injectionmediumCVSS 4.3EPSS 0.3%
- CVE-2026-84654: Stapler form data binding allows setting public static fields in JenkinsmediumCVSS 5.4EPSS 0.3%
- CVE-2026-84653: Jenkins Appearance configuration permission bypasslowCVSS 3.5EPSS 0.3%
- CVE-2026-84652: Jenkins session fixation via remember me cookiehighCVSS 7.3EPSS 0.4%
- CVE-2026-84651: Jenkins agent configuration privilege escalationmediumCVSS 6.3EPSS 0.3%
- CVE-2026-84650: Jenkins transient field deserialization bypasshighCVSS 8.8EPSS 0.5%
- CVE-2026-84649: Stapler CSRF token exposure in dynamically generated JavaScripthighCVSS 8.8EPSS 0.2%
- CVE-2026-84648: Jenkins system log viewer stored XSS in metadatahighCVSS 8.8EPSS 0.6%
- CVE-2026-84647: Stapler type instantiation bypass in JenkinshighCVSS 8.8EPSS 0.5%
- CVE-2026-84646: Jenkins user object deserialization bypassmediumCVSS 4.3EPSS 0.3%
- CVE-2026-84645: Jenkins deserialization RCE in config.xml handlinghighCVSS 8.8EPSS 0.8%
- CVE-2026-53442: Jenkins plaintext secret storage in job config.xml submissionsmediumCVSS 5.3EPSS 0.2%
- CVE-2026-53440: Jenkins open redirect in Delegate to servlet container security realmmediumCVSS 4.3EPSS 0.4%
- CVE-2026-53439: Jenkins missing permission checks in user profile endpointsmediumCVSS 4.3EPSS 0.3%
- CVE-2026-53437: Jenkins open redirect via tab or newline characters in login URLmediumCVSS 4.3EPSS 0.7%
- CVE-2026-53436: Jenkins open redirect via relative path segments in login flowmediumCVSS 4.3EPSS 0.4%
- CVE-2026-53435: Jenkins arbitrary type deserialization in config.xml processinghighCVSS 8.8EPSS 2.2%
- CVE-2024-23897: Arbitrary file read vulnerability through the Jenkins CLI can lead to RCEcriticalexploited in the wildCVSS 3.1EPSS 100.0%
- CVE-2015-5317: Jenkins discloses project names via fingerprintscriticalexploited in the wildCVSS 3.1EPSS 23.0%
- CVE-2017-1000353: Deserialization of Untrusted Data in Jenkinscriticalexploited in the wildCVSS 3EPSS 99.7%
- CVE-2018-1000861: Deserialization of Untrusted Data in Jenkinscriticalexploited in the wildCVSS 3EPSS 98.3%
- CVE-2016-9299: Jenkins remoting module Java deserialization RCE via LDAP querycriticalCVSS 9.8EPSS 96.9%
Most severe Jenkins vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2024-23897: Arbitrary file read vulnerability through the Jenkins CLI can lead to RCEcriticalexploited in the wildCVSS 3.1EPSS 100.0%
- CVE-2015-5317: Jenkins discloses project names via fingerprintscriticalexploited in the wildCVSS 3.1EPSS 23.0%
- CVE-2017-1000353: Deserialization of Untrusted Data in Jenkinscriticalexploited in the wildCVSS 3EPSS 99.7%
- CVE-2018-1000861: Deserialization of Untrusted Data in Jenkinscriticalexploited in the wildCVSS 3EPSS 98.3%
- CVE-2016-9299: Jenkins remoting module Java deserialization RCE via LDAP querycriticalCVSS 9.8EPSS 96.9%
- CVE-2026-53435: Jenkins arbitrary type deserialization in config.xml processinghighCVSS 8.8EPSS 2.2%
- CVE-2026-84645: Jenkins deserialization RCE in config.xml handlinghighCVSS 8.8EPSS 0.8%
- CVE-2026-84648: Jenkins system log viewer stored XSS in metadatahighCVSS 8.8EPSS 0.6%
- CVE-2026-84647: Stapler type instantiation bypass in JenkinshighCVSS 8.8EPSS 0.5%
- CVE-2026-84650: Jenkins transient field deserialization bypasshighCVSS 8.8EPSS 0.5%
Vulnerabilities per week
The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 6 Jul 2026 | 0 | 0 | |
| 13 Jul 2026 | 0 | 0 | |
| 20 Jul 2026 | 0 | 0 | |
| 27 Jul 2026 | 0 | 0 | |
| 3 Aug 2026 | 0 | 0 | |
| 10 Aug 2026 | 0 | 0 | |
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 13 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 |
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/jenkins.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Jenkins vulnerabilities", https://junglewise.ai/threats/technologies/jenkins, 28 September 2026.