CVE-2026-53435

Jenkins weekly releases through 2.567 and LTS releases through 2.555.2 deserialize arbitrary Java types defined in Jenkins core or plugins when processing an attacker-controlled config.xml submission (CWE-502, deserialization of untrusted data). An attacker with low-level privileges who can submit a crafted config.xml causes deserialized objects to handle subsequent HTTP requests, letting the attacker impersonate any user and send requests on that user's behalf. This can be escalated to full compromise, including running arbitrary code via the Script Console or reading arbitrary files from the Jenkins controller, consistent with the high severity (CVSS 8.8) and high ratings for confidentiality, integrity, and availability. Any organization running an affected Jenkins weekly or LTS release is exposed, although the attacker must have at least some valid low-level access to the controller to trigger the flaw. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 53.1% probability of exploitation within 30 days (99th percentile), signaling a high risk of imminent exploit activity.

What to do: Upgrade all controllers to a Jenkins weekly release later than 2.567 or an LTS release later than 2.555.2 as soon as the fix is available. Until patched, restrict which accounts can create or configure jobs and submit config.xml, and review Script Console permissions, since those amplify the impact. Prioritize internet-exposed controllers given the elevated EPSS score, and monitor logs for unexpected privileged HTTP requests or unusual config.xml submissions.