CVE-2017-1000353

CVE-2017-1000353 is an unauthenticated remote code execution flaw in the Jenkins CLI (CWE-502): an attacker can send a crafted serialized Java SignedObject to the remoting-based CLI endpoint, where it is deserialized with a new ObjectInputStream and bypasses Jenkins' existing blacklist-based deserialization protection. Triggering it requires only network reachability to the Jenkins remoting CLI — no authentication or user interaction — which is why the flaw scores 9.8 (critical) under CVSS 3.1. Successful exploitation gives arbitrary code execution with the privileges of the Jenkins process, i.e., full control of the CI/CD server and any credentials, source code, and build infrastructure it holds; Jenkins servers have historically been targeted for cryptomining campaigns such as JenkinsMiner, which reportedly generated $3.4 million. All Jenkins versions 2.56 and earlier and 2.46.1 LTS and earlier are affected, including Oracle Communications Cloud Native Core Automated Test Suite deployments that bundle affected Jenkins releases. Exploitation status is serious: a public proof-of-concept exploit exists (Exploit-DB 41965), EPSS estimates a 99.7% probability of exploitation within 30 days, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-10-02.

What to do: Upgrade to Jenkins 2.57 or later (weekly line) or 2.46.2 LTS or later, which add SignedObject to the deserialization blacklist, backport the HTTP CLI protocol, and deprecate/disable the remoting (Java serialization) CLI by default; as an interim mitigation, disable or restrict access to the remoting CLI (e.g., the /cli endpoint) from untrusted networks. Because the flaw is in CISA's KEV catalog, federal agencies must apply vendor mitigations or discontinue use per BOD 22-01, and all administrators of internet-facing Jenkins instances should check for signs of compromise such as cryptomining processes. Oracle Communications Cloud Native Core Automated Test Suite users should apply the applicable Oracle security patch/update addressing CVE-2017-1000353.