Jenkins Patches High-Severity Deserialization Flaw CVE-2026-53435 That Turns a config.xml Submission Into Controller-Side Code Execution

Overview

The Jenkins project has patched a high-severity deserialization vulnerability in its automation server that lets an attacker turn a crafted configuration submission into code execution on the Jenkins controller. The flaw, tracked as CVE-2026-53435 and assigned the internal identifier SECURITY-3707, was disclosed in the Jenkins Security Advisory dated June 10, 2026. According to the National Vulnerability Database, the issue carries a CVSS v3.1 base score of 8.8 and a severity rating of High.

What We Know

The vulnerability lives in how Jenkins processes configuration data. Per the NVD entry, “it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards.” The same advisory text describes the consequences directly: the flaw “can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.”

The practical effect is a chain that begins with a single configuration POST and ends at the most privileged surface in a Jenkins installation. The Jenkins advisory states that attackers can impersonate any user and send HTTP requests on their behalf, and separately that attackers can read arbitrary files from the Jenkins controller. The Script Console it references is an administrative Groovy interface that runs code with the controller’s own privileges, which is what makes the issue a remote-code-execution risk rather than a configuration-disclosure bug.

The NVD record lists the CVSS vector as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity attack that requires only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability. The GitHub Advisory Database entry, GHSA-g2xq-2v27-4rh3, independently records the same 8.8 High rating and the same vector string.

Affected and Fixed Versions

The Jenkins advisory lists Jenkins weekly releases up to and including 2.567 and Jenkins LTS releases up to and including 2.555.2 as affected. The fixes ship in Jenkins weekly 2.568 and Jenkins LTS 2.555.3. CVE-2026-53435 was one of several issues in the June 10 advisory, which also assigned CVE-2026-53436 through CVE-2026-53442.

Reports of Exploitation

Security trade press reported active exploitation within days of disclosure. GBHackers wrote that “exploitation attempts were observed as early as June 15, 2026, with attackers targeting exposed Jenkins instances using automated scanning and exploitation techniques, according to threat intelligence shared by DefusedCyber.” Cyber Press similarly attributed the activity to Defused honeypot telemetry and reported that a public proof-of-concept was published within days of disclosure. These exploitation claims rest on threat-intelligence reporting rather than on the vendor advisory, and could not be independently confirmed against a primary source at the time of writing.

The indicators described by GBHackers align with the documented attack path: “unusual HTTP POST requests targeting Jenkins configuration endpoints, anomalous modifications to config.xml, and unexpected outbound connections from Jenkins servers.”

What We Don’t Know

The vendor advisory and the NVD record do not characterize exploitation activity, the number of affected internet-facing instances, or any attribution. The CVSS rating and vector are consistent across the Jenkins advisory, the NVD, and the GitHub Advisory Database at 8.8 High; figures circulating in some secondary write-ups that label the flaw “critical” do not match those primary sources.

Context

The disclosure adds to a run of CI/CD and developer-tooling security incidents. Jenkins itself was at the center of a supply-chain compromise last month, when the Checkmarx Jenkins AST plugin was backdoored for roughly 31 hours. That earlier case involved a malicious plugin build rather than a flaw in the server itself; CVE-2026-53435 is a vulnerability in the way Jenkins core handles configuration data, and the remediation is to upgrade to the patched weekly or LTS release rather than to remove a plugin.