Skip to content
brandefense.io
Request A Demo
On CISA KEVHigh

CVE-2026-53435Jenkins Insecure Deserialization

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards.

Published Jun 10, 2026 · Updated Oct 24, 2026 · Also known as BIT-jenkins-2026-53435, GHSA-g2xq-2v27-4rh3

Key Facts

Patch immediately
  • CVE-2026-53435 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Jenkins, 4.12 (Ocp Tools), 4.13 (Ocp Tools) and 12 more products.
  • It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Jun 15, 2026. No public exploit code is known.
  • EPSS estimates a 53% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Jenkins 2.555.3, Jenkins 2.568-r0, Jenkins 2.568.0.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Scores

CVSS v3.1

8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

53%

Higher than 98.9% of all scored CVEs

Exploit maturity

Exploited (KEV)

ATLAS score

60/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Jun 15, 2026

5 days after publication

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Exploited (KEV)

Public exploit code

0

Proof-of-concept links

In-the-wild evidence

1

Reports of active use

Advisories And Exploit References

Description

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CIRCL KEVJun 15, 2026n/aNot reported
Industry KEV feedJun 15, 2026n/aNot reported

Affected Products

36 affected entries in total
ProductAffected versionsFixed in
JenkinsJenkinsSee advisory2.568
4.12Ocp ToolsSee advisory1786628667
4.13Ocp ToolsSee advisory1786628681
4.14Ocp ToolsSee advisory1786533561
4.15Ocp ToolsSee advisory1786533565
10 more affected products in the full CVE brief

Patched Releases

Jenkins

2.555.3, 2.568-r0, 2.568.0, 2.568

jenkins-2.555

2.555.3-r0

ocp-tools

4/jenkins-rhel9:1787125166, 1786533561, 1786533565, 1786628667, 1786628681, 1787124632, 1787124635, 1787124779, 1787124925, 1787125069, 1787125166, 1787125311

org.jenkins-ci.main:jenkins-core

2.555.3, 2.568

Timeline

  1. Publicly disclosed

    Jun 10, 2026

  2. Added to CIRCL KEV

    Jun 15, 2026

  3. Added to Industry KEV feed

    Jun 15, 2026

  4. Last updated

    Oct 24, 2026

Weakness Type

  • CWE-502 Deserialization of Untrusted Data

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2026-53435 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.

Request A Demo

More vulnerabilities

Figures as of Oct 25, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.