CVE-2017-1000353
CriticalExploitedPublic exploitDeserialization of Untrusted Data in Jenkins
Published May 13, 2022 · Updated Jul 8, 2026 · Also known as GHSA-26wc-3wqp-g3rp
Key Facts
Patch immediately- CVE-2017-1000353 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Jenkins, Communications Cloud Native Core Automated Test Suite (Oracle), org.jenkins-ci.main:jenkins-core (maven).
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jul 7, 2018. Public exploit code is available.
- EPSS estimates a 100% probability of exploitation in the next 30 days.
- Fixed versions are available, including Jenkins <=2.46.1, Jenkins <=2.56, org.jenkins-ci.main:jenkins-core 2.46.2.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
100%
Higher than 99.9% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2017-1000353 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java SignedObject object to the Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding SignedObject to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Oct 2, 2025 | Oct 23, 2025 | Not reported |
| Industry KEV feed | Jul 7, 2018 | Oct 23, 2025 | Not reported |
| CIRCL KEV | Oct 2, 2025 | Oct 23, 2025 | Not reported |
| ENISA EUVD | Oct 2, 2025 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| JenkinsJenkins | See advisory | 2.56 |
| Communications Cloud Native Core Automated Test SuiteOracle | 1.9.0 | n/a |
| org.jenkins-ci.main:jenkins-coremaven | >= 2.50 | 2.57 |
Patched Releases
Jenkins
<=2.46.1, <=2.56
org.jenkins-ci.main:jenkins-core
2.46.2, 2.57
Timeline
Added to Industry KEV feed
Jul 7, 2018
Publicly disclosed
May 13, 2022
Added to CISA KEV
Oct 2, 2025
Added to CIRCL KEV
Oct 2, 2025
Added to ENISA EUVD
Oct 2, 2025
Last updated
Jul 8, 2026
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
- advisoryGHSA advisory
- advisoryhttps://jenkins.io/security/advisory/2017-04-26/
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2017-1000353
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
FAQ
Common Questions.
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.
Affected: Jenkins; Communications Cloud Native Core Automated Test Suite (Oracle) versions 1.9.0; org.jenkins-ci.main:jenkins-core (maven) versions >= 2.50. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jul 7, 2018.
Yes. It was added on Oct 2, 2025 with a federal remediation due date of Oct 23, 2025.
Public exploit code is available.
Fixed versions are available, including Jenkins <=2.46.1, Jenkins <=2.56, org.jenkins-ci.main:jenkins-core 2.46.2.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2017-1000353 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo