Technology · Jenkins
Jenkins vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 42 vulnerabilities in Jenkins: 0 in the last 7 days and 27 in the last 90 days, 4 of them critical and 3 exploited in the wild. The most recent, CVE-2026-117626, was published on 28 October 2026. 14 vulnerabilities in the last four weeks, up from none in the four before.
- Last 7 days
- 0
- Last 90 days
- 27
- Critical, all time
- 4
- Exploited in the wild
- 3
About Jenkins
Jenkins is an open-source automation server used for continuous integration and delivery.
Latest Jenkins vulnerabilities
- CVE-2026-117626: Jenkins path traversal in file browser workspace disclosureinfo
- CVE-2026-117625: Jenkins missing HTTP proxy permission checkinfo
- CVE-2026-117624: Jenkins deserialization filter bypass in XStream resolves-to attributeinfo
- CVE-2026-117623: Jenkins stored cross-site scripting in breadcrumb menu tooltipsinfo
- CVE-2026-117622: Jenkins agent XSS via Stapler HttpResponse exceptionsinfo
- CVE-2026-117621: Jenkins workspace browser XSS in agent URL computationinfo
- CVE-2026-117620: Jenkins Manage Old Data injection allows password overrideinfo
- CVE-2026-117619: Jenkins "remember me" cookie obtained via API token authenticationinfo
- CVE-2026-117617: Jenkins symbolic link in artifact extraction path traversalinfo
- CVE-2026-117616: Jenkins path traversal in agent name loadinginfo
- CVE-2026-117615: Jenkins arbitrary file read via symlink following during item renameinfo
- CVE-2026-117614: Jenkins agent launch command approval bypassinfo
- CVE-2026-117613: Jenkins collection element type validation bypassinfo
- CVE-2026-117612: Jenkins XStream deserialization filter bypass via resolves-to attributeinfo
- CVE-2026-84657: Jenkins build CLI command authorization bypass via -s flagmediumCVSS 4.2EPSS 0.3%
- CVE-2026-84656: Jenkins missing permission check on build parametersmediumCVSS 4.3EPSS 0.3%
- CVE-2026-84655: Jenkins REST API JSON key injectionmediumCVSS 4.3EPSS 0.3%
- CVE-2026-84654: Stapler form data binding allows setting public static fields in JenkinsmediumCVSS 5.4EPSS 0.3%
- CVE-2026-84653: Jenkins Appearance configuration permission bypasslowCVSS 3.5EPSS 0.3%
- CVE-2026-84652: Jenkins session fixation via remember me cookiehighCVSS 7.3EPSS 0.4%
- CVE-2026-84651: Jenkins agent configuration privilege escalationmediumCVSS 6.3EPSS 0.3%
- CVE-2026-84650: Jenkins transient field deserialization bypasshighCVSS 8.8EPSS 0.5%
- CVE-2026-84649: Stapler CSRF token exposure in dynamically generated JavaScripthighCVSS 8.8EPSS 0.2%
- CVE-2026-84648: Jenkins system log viewer stored XSS in metadatahighCVSS 8.8EPSS 0.6%
- CVE-2026-84647: Stapler type instantiation bypass in JenkinshighCVSS 8.8EPSS 0.5%
Most severe Jenkins vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2015-5317: Jenkins discloses project names via fingerprintscriticalexploited in the wildCVSS 3.1EPSS 23.0%
- CVE-2017-1000353: Deserialization of Untrusted Data in Jenkinscriticalexploited in the wildCVSS 3EPSS 99.7%
- CVE-2018-1000861: Deserialization of Untrusted Data in Jenkinscriticalexploited in the wildCVSS 3EPSS 98.3%
- CVE-2016-9299: Jenkins remoting module Java deserialization RCE via LDAP querycriticalCVSS 9.8EPSS 96.9%
- CVE-2026-53435: Jenkins arbitrary type deserialization in config.xml processinghighCVSS 8.8EPSS 2.2%
- CVE-2026-84645: Jenkins deserialization RCE in config.xml handlinghighCVSS 8.8EPSS 0.8%
- CVE-2026-84648: Jenkins system log viewer stored XSS in metadatahighCVSS 8.8EPSS 0.6%
- CVE-2026-84647: Stapler type instantiation bypass in JenkinshighCVSS 8.8EPSS 0.5%
- CVE-2026-84650: Jenkins transient field deserialization bypasshighCVSS 8.8EPSS 0.5%
- CVE-2026-84649: Stapler CSRF token exposure in dynamically generated JavaScripthighCVSS 8.8EPSS 0.2%
Vulnerabilities per week
14 vulnerabilities in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 13 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 14 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Jenkins vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/jenkins)<a href="https://junglewise.ai/threats/technologies/jenkins"><img src="https://junglewise.ai/threats/technologies/jenkins/badge.svg" alt="Jenkins vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/jenkins.json, and this page as text at https://junglewise.ai/threats/technologies/jenkins.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Jenkins vulnerabilities", https://junglewise.ai/threats/technologies/jenkins, 9 November 2026.