Jenkins vendor intelligence

Jenkins Known Exploited Vulnerabilities

Track evidence-backed exploitation affecting Jenkins products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.

Browse Jenkins KEVs Full KEV feed

Total KEVs: 8; Known exploited vulnerabilities affecting Jenkins products
In CISA KEV: 6; Records also listed in the official catalog
Beyond CISA KEV: 2; Additional exploited CVEs absent from CISA KEV
Sensor Observed: 0; Jenkins KEVs with sensor-observed exploitation activity

The catalog gap matters for Jenkins exposure

Two of the eight exploited Jenkins CVEs tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss one-quarter of this vendor portfolio.

75%
Covered by CISA: 25%
Beyond CISA: 3
Product families

Attested Jenkins CVEs

Search the exploited-vulnerability portfolio, then narrow it to official CISA coverage or the additional records KEV Intelligence tracks beyond the catalog.

How exploitation is verified

CVE / description	Product	Confidence	CISA KEV	Added
CVE-2026-53435 In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins...	Jenkins	High	Beyond CISA	15 Jun 2026
CVE-2025-59474 Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users...	Jenkins	High	Beyond CISA	26 Oct 2025
CVE-2017-1000353 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated...	Jenkins	Confirmed	In CISA	01 Jun 2026
CVE-2018-1000861 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in...	Jenkins	Confirmed	In CISA	10 Feb 2022
CVE-2019-1003030 A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml,...	Jenkins Pipeline: Groovy Plugin	Confirmed	In CISA	25 Mar 2022
CVE-2019-1003029 A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in...	Jenkins Script Security Plugin	Confirmed	In CISA	25 Apr 2022
CVE-2015-5317 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name...	Jenkins	Confirmed	In CISA	12 May 2023
CVE-2024-23897 Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by...	Jenkins	Confirmed	In CISA	19 Aug 2024

Showing 8 of 8 Jenkins known exploited vulnerabilities.

Recurring weakness patterns

Deserialization, exposure, and path traversal: 'dir/../../filename' account for five mapped occurrences across this Jenkins KEV portfolio.

Browse all KEVs →

CWE-502

Deserialization of Untrusted Data

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-27

Path Traversal: 'dir/../../filename'

CWE-693

Protection Mechanism Failure

CWE-862

Missing Authorization

Early warning alerts

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.