Critical severity · published Jan 29, 2018
CVE-2017-1000353
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution
In wildKEV
9.8
CVSS
99.7%
EPSS
Yes
On KEV
Description
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 2, 2025
Federal remediation dueOct 23, 2025
Ransomware campaign useNot known
Affected products
Which versions
JE
Jenkins · Jenkins
through 2.56; through 2.46.1 · source: NVD, KEV
CC
Communications Cloud Native Core Automated Test Suite · Oracle
1.9.0 · source: NVD
In the news
VulnerabilityCritical
[CISA KEV] CVE-2017-1000353: Jenkins Jenkins - Jenkins Remote Code Execution Vulnerability
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
JEJenkinsCVE-2017-1000353
Oct 2, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-1000353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-1000353
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Permissions Required
http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html
Broken Link
http://www.securityfocus.com/bid/98056
Vendor Advisory
https://jenkins.io/security/advisory/2017-04-26/
Exploit
https://www.exploit-db.com/exploits/41965/
Patch
https://www.oracle.com/security-alerts/cpuapr2022.html
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000353
More from Jenkins
9.9
CVE-2019-1003029
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
9.9
CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
9.8
CVE-2024-23897
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
9.8
CVE-2018-1000861
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in…
7.5
CVE-2015-5317
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request