Jenkins flaws being used in attacks

CISA lists 6 flaws in Jenkins products as being used in attacks, most recently on 2 Oct 2025. 1 has been used in ransomware.

What to do

1. Update every Jenkins product you use.Install the updates Jenkins offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 2 Oct 2025
   Jenkins
   CVE-2017-1000353Jenkins Remote Code Execution Vulnerability
   Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
2. Being used in attacksUsed in ransomwareAdded by CISA on 19 Aug 2024
   Jenkins Command Line Interface (CLI)
   CVE-2024-23897Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
   Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
3. Being used in attacksAdded by CISA on 12 May 2023
   Jenkins User Interface (UI)
   CVE-2015-5317Jenkins User Interface (UI) Information Disclosure Vulnerability
   Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
4. Being used in attacksAdded by CISA on 25 Apr 2022
   Jenkins Script Security Plugin
   CVE-2019-1003029Jenkins Script Security Plugin Sandbox Bypass Vulnerability
   Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
5. Being used in attacksAdded by CISA on 25 Mar 2022
   Jenkins Matrix Project Plugin
   CVE-2019-1003030Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
   Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
6. Being used in attacksAdded by CISA on 10 Feb 2022
   Jenkins Stapler Web Framework
   CVE-2018-1000861Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
   A code execution vulnerability exists in the Stapler web framework used by Jenkins
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Jenkins on CISA’s site.