{"meta":{"title":"KEV entries: Jenkins","description":"All KEV entries for vendor Jenkins.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":6,"vendor":"Jenkins","entries":6,"shareOfCatalogPercent":0.3,"ransomwareKnown":1,"firstDateAdded":"2022-02-10","latestDateAdded":"2025-10-02","rank":38},"data":[{"cveID":"CVE-2017-1000353","vendorProject":"Jenkins","product":"Jenkins","vulnerabilityName":"Jenkins Remote Code Execution Vulnerability","dateAdded":"2025-10-02","dueDate":"2025-10-23","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.jenkins.io/security/advisory/2017-04-26/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-1000353","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2017-1000353"},{"cveID":"CVE-2024-23897","vendorProject":"Jenkins","product":"Jenkins Command Line Interface (CLI)","vulnerabilityName":"Jenkins Command Line Interface (CLI) Path Traversal Vulnerability","dateAdded":"2024-08-19","dueDate":"2024-09-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-27"],"shortDescription":"Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314; https://nvd.nist.gov/vuln/detail/CVE-2024-23897","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-23897"},{"cveID":"CVE-2015-5317","vendorProject":"Jenkins","product":"Jenkins User Interface (UI)","vulnerabilityName":"Jenkins User Interface (UI) Information Disclosure Vulnerability","dateAdded":"2023-05-12","dueDate":"2023-06-02","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-200"],"shortDescription":"Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the \"Fingerprints\" pages.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.jenkins.io/security/advisory/2015-11-11/; https://nvd.nist.gov/vuln/detail/CVE-2015-5317","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2015-5317"},{"cveID":"CVE-2019-1003029","vendorProject":"Jenkins","product":"Script Security Plugin","vulnerabilityName":"Jenkins Script Security Plugin Sandbox Bypass Vulnerability","dateAdded":"2022-04-25","dueDate":"2022-05-16","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003029","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1003029"},{"cveID":"CVE-2019-1003030","vendorProject":"Jenkins","product":"Matrix Project Plugin","vulnerabilityName":"Jenkins Matrix Project Plugin Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003030","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1003030"},{"cveID":"CVE-2018-1000861","vendorProject":"Jenkins","product":"Jenkins Stapler Web Framework","vulnerabilityName":"Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"A code execution vulnerability exists in the Stapler web framework used by Jenkins","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000861","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-1000861"}]}