CVE-2026-53435Active Exploitation(jenkins / jenkins)

HIGHCVSS 8.8 · HIGH

Exploitation observed; activity peaked at 12 mentions and remains active

Immediate actions

Patch jenkins jenkins systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

jenkins CVEs Back to dashboard

7.8/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707

Other references

Weakness type (CWE)

CWE-502

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

jenkins

Threat summary

Active exploitation appears in 14 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
31 mentions across 12 observed days

What's happening

Active exploitation reported across 14 signals
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 8 signals
Technical details provided in 22 signals
Disclosure: 7 classified signals
General: 5 classified signals
Peaked 9d ago at 12 mentions (2026-06-15); latest day: 1
31 total mentions across 12 days

Affected systems

Vendors

jenkins

Products

jenkins

Deep dive

Activity timeline31 mentions / 12d

Signal classification6 categories

Active Exploitation

1341.9%

Disclosure

722.6%

General

516.1%

Patch

39.7%

PoC

26.5%

Exploit

13.2%

Referenced assets23 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-10	2	Disclosure2
2026-06-11	1	Patch1
2026-06-15	12	Active Exploitation7Disclosure1Exploit1Patch2PoC1
2026-06-16	3	Active Exploitation3
2026-06-17	3	Disclosure1General1PoC1
2026-06-18	1	Active Exploitation1
2026-06-22	1	Active Exploitation1
2026-07-02	1	General1
2026-07-07	1	General1
2026-07-11	4	Disclosure2General2
2026-08-28	1	Active Exploitation1
2026-09-03	1	Disclosure1

Full discourse20 posts

Rishi@rxerium131d
Active Exploitation
🚨 CVE-2026-53435, a high severity (CVSS 8.8) deserialization vulnerability in Jenkins is now seeing active exploitation as per @DefusedCyber. Scan your infrastructure: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-53435.yaml Patches are available per the vendor advisory: https://www.jenkins.io/security/advisory/2026-06-10/ https://t.co/VodN95SUob
Post summary
CVE-2026-53435 is a high‑severity Jenkins deserialization flaw (CVSS 8.8) that is actively exploited per DefusedCyber, and available patches are referenced in the vendor advisory.
3105241820928.0K
3.8K followersView on X
pyn3rd@pyn3rd132d
Disclosure
#CVE-2026-53435: #Jenkins Unsafe XStream Deserialization Leads to Arbitrary File Read (low-privileged authenticated user) https://t.co/vm8BXAtZhf
Post summary
The tweet announces CVE-2026-53435, highlighting an unsafe XStream deserialization in Jenkins that allows arbitrary file reads by low‑privileged authenticated users.
750132911819.0K
15.2K followersView on X
Defused@DefusedCyber132d
Active Exploitation
🚨 CVE-2026-53435 (Jenkins config.xml deserialization / potential RCE) is now under active exploitation We're seeing in-the-wild attempts hitting our decoys since early this morning Track Jenkins exploitation live 👉https://console.defusedcyber.com/signup https://t.co/BPwVGlTupi
Post summary
CVE-2026-53435 is currently being exploited in the wild against Jenkins via config.xml deserialization, with attackers targeting potential RCE. No PoC, exploit code, or patch is mentioned.
121181348.1K
7.6K followersView on X
dbugs@ptdbugs132d
Exploit
CVE: CVE-2026-53435 PT ID: PT-2026-48420 Vendor: Jenkins Project Product: Jenkins CVSS: 8.8 Credits: n/a Description: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled "config.xml" submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-53435 • https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707 PoC/Exploit: https://github.com/AmesianX/CVE-2026-53435 #dbugs_vuln
Post summary
The post announces a Jenkins vulnerability with detailed technical information and provides a link to functional exploit code, but does not indicate active exploitation or a patch.
1401651.3K
3.0K followersView on X
Daily CyberSecurity@the_yellow_fall136d
Patch
A critical Jenkins security advisory 2026 warns of deserialization and XSS flaws like CVE-2026-53435. Patch your CI/CD pipelines immediately! #Jenkins #Cybersecurity #CVE2026 #InfoSec #Vulnerability https://securityonline.info/jenkins-security-advisory-2026-critical-cves/ https://t.co/56SUXiLker
Post summary
The advisory highlights deserialization and XSS flaws in Jenkins (CVE‑2026‑53435) and urges users to apply patches immediately.
040112598
12.6K followersView on X
kokumօtօ@__kokumoto132d
Active Exploitation
Jenkinsの遠隔コード実行脆弱性CVE-2026-53435が悪用されている。DefusedCyber社報告。ハニーポットでの観測。悪用は脆弱性情報開示後数時間で開始。 https://securityonline.info/jenkins-rce-vulnerability-cve-2026-53435/
Post summary
Jenkins CVE-2026-53435 is actively exploited in the wild, as evidenced by honeypot observations occurring just hours after disclosure.
110741.0K
7.7K followersView on X
The CyberSec Guru@thecybersecguru132d
PoC
@pyn3rd Here's PoC and all courtesy of AmesianX. Explained much more in depth...technicalities https://thecybersecguru.com/news/cve-2026-53435-jenkins-deserialization/
Post summary
The tweet announces a proof‑of‑concept for CVE-2026-53435, a Jenkins deserialization flaw, with further technical details implied in the linked article.
00064835
1.2K followersView on X
Daily CyberSecurity@the_yellow_fall132d
Active Exploitation
A Jenkins RCE vulnerability (CVE-2026-53435) is under active exploitation. Honeypots are seeing attacks now, so patch your Jenkins controller fast. #Jenkins #CVE202653435 #RCE #ActiveExploitation #InfoSec https://securityonline.info/jenkins-rce-vulnerability-cve-2026-53435 https://t.co/cVLWpeIeJS
Post summary
The post alerts that Jenkins CVE-2026-53435 RCE is actively being exploited and urges users to patch immediately.
02060538
12.8K followersView on X
Lyrie.ai@lyrie_ai106d
General
Source: X search for PoC exploit 2026 Posted: 2026-06-15T08:48:15.000Z Likes: 17 0day Intel: CVE: CVE-2026-53435 PT ID: PT-2026-48420 Vendor: Jenkins Project Product: Jenkin
Post summary
The post lists a zero‑day CVE (CVE‑2026‑53435) for Jenkins but offers no technical details, PoC, or exploitation evidence.
2001069
310 followersView on X
Lyrie.ai@lyrie_ai106d
General
0day Intel: CVE: CVE-2026-53435 PT ID: PT-2026-48420 Vendor: Jenkins Project Product: Jenkin
Post summary
The text simply announces the existence of a new 0day CVE (CVE-2026-53435) for Jenkins without providing technical, exploit, patch, or deployment details.
1001042
310 followersView on X
Lyrie.ai@lyrie_ai106d
Disclosure
Full Tweet CVE: CVE-2026-53435 PT ID: PT-2026-48420 Vendor: Jenkins Project Product: Jenkins CVSS: 8.8 Credits: n/a 0day Intel: CVE: CVE-2026-53435 PT ID: PT-2026-48420 Vendor: Jenkins Project Product: Jenkin
Post summary
The tweet announces a new CVE against Jenkins with a CVSS score but provides no exploit details or mitigation, making it a straightforward disclosure.
1001050
310 followersView on X
Lyrie.ai@lyrie_ai106d
Disclosure
CVE-2026-53435: CVE: CVE-2026-53435 PT ID: PT-2026-48420 Vendor: Jenkins Project Product: Jenkins CVSS: 8.8 Credits: n/a Description: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in…
Post summary
The text announces CVE-2026-53435 for Jenkins, describing that attackers can deserialize arbitrary types in affected versions; it contains no evidence of exploitation, PoC, or patch information.
1001049
310 followersView on X
iototsecnews@iototsecnews125d
Active Exploitation
Jenkins の RCE 脆弱性 CVE-2026-53435：デシリアライズを悪用する攻撃キャンペーンを観測 https://iototsecnews.jp/2026/06/15/jenkins-rce-flaw-exploited-by-attackers-in-the-wild/ この問題の原因は、 Jenkins の設定ファイルである config.xml が処理される際に、安全でないデシリアライズが実行される点にあります。この仕組みを悪用する攻撃者は、細工したデータを注入することで、サーバ上で任意のコードを実行できてしまいます。特に、パッチが未適用でインターネットに公開されている環境や、適切な認証制御が欠けている環境が狙われやすくなっています。この脆弱性 CVE-2026-53435 は、実環境で積極的に悪用されています。開発パイプラインの中核である Jenkins が侵害されると、機密情報の漏洩やビルドプロセスの改竄などの組織全体への深刻な影響が生じる可能性があります。ご利用のチームは、ご注意ください。 #CVE202653435 #CyberAttack #Exploit #Jenkins #Vulnerability
Post summary
The post reports Jenkins CVE‑2026‑53435, a deserialization‑based remote code execution flaw, is being actively exploited in the wild. No PoC, exploit code, patch or workaround is provided, but the technical description confirms the RCE risk.
00001162
500 followersView on X
Rapid Risk Radar@rapidriskradar129d
Active Exploitation
🚨Jenkins deserialization (CVE-2026-53435) — active exploitation reported. Malicious config.xml can let attackers impersonate users, forge requests, and reach the Script Console. More → https://app.rapidriskradar.com/cve/CVE-2026-53435 https://t.co/uF90fpzvwq
Post summary
CVE‑2026‑53435 involves deserialization in Jenkins; a malicious config.xml lets attackers impersonate users, forge requests, and access the Script Console, and these capabilities are currently being exploited in the wild.
0000136
15 followersView on X
CCB Alert@CCBalert130d
Disclosure
Warning: High Arbitrary Code Execution Vulnerability in #Jenkins. CVE-2026-53435 CVSS: 8.8. This can lead to user impersonation and the exposure of arbitrary files. #Patch #Patch #Patch
Post summary
The tweet warns about a high-severity arbitrary code execution vulnerability in Jenkins (CVE-2026-53435) and indicates that a patch is available.
01000242
7.2K followersView on X
Cyber Edition@CyberEdition132d
Active Exploitation
🚨 Attackers are actively exploiting critical Jenkins flaw CVE-2026-53435 (CVSS 9.0). The bug can lead to full RCE on vulnerable controllers, and real-world attack attempts are already being detected. If you run Jenkins, patch immediately. #Jenkins https://thecyberedition.com/critical-jenkins-rce-vulnerability-exploited-patch-now/
Post summary
CVE-2026-53435 is being actively exploited in real‑world attacks with full remote code execution in Jenkins. Users are urged to patch immediately.
0000156
736 followersView on X
Hephaestvs@Vulcanux_132d
Active Exploitation
csirt_it: ‼️ #Jenkins: rilevato sfruttamento attivo in rete della CVE-2026-53435 Rischio: 🔴 ⚠️Ove non provveduto, si raccomanda l’aggiornamento tempestivo del software interessato https://x.com/csirt_it/status/2066533268212584627/photo/1 https://x.com/csirt_it/status/2064721615485567367
Post summary
The tweet announces that CVE‑2026‑53435 is currently being exploited in the wild and urges a prompt update of the Jenkins software to mitigate the risk.
1000045
619 followersView on X
BT Haberler@BTHaberler52d
Disclosure
Jenkins'teki Kritik Bir Açık, Düşük Yetkili Kullanıcıların Uzaktan Kod Çalıştırmasına İzin Veriyor! Popüler CI/CD platformu Jenkins'te bulunan CVE-2026-53435 (CVSS 8.8) açığı, düşük yetkili bir kullanıcının özel hazırlanmış bir config.xml dosyası göndererek sunucuda rastgele Java sınıfları yükletmesine ve sonuç olarak uzaktan kod çalıştırmasına izin veriyor. • Açık, XStream bileşenindeki yetersiz filtrelemeden kaynaklanıyor; DescribableList nesnesi hiçbir filtreleme yapmadan tüm özellikleri işlediği için, saldırgan bu mekanizmayı kötüye kullanarak yapılandırma dosyalarını okuyabiliyor, HTTP isteklerini ele geçirebiliyor ve uzaktan kod çalıştırabiliyor. • Açık, kendi sunucusunda Jenkins çalıştıran DevOps ekiplerini ve kuruluşları etkiliyor; bu tür deserialization açıkları CI/CD platformlarında tarihsel olarak sıkça görülen bir zafiyet sınıfı. Bir CI/CD platformundaki bu tür bir açığın istismar edilmesi, sadece bir sunucuyu değil, o platform üzerinden dağıtılan tüm yazılım tedarik zincirini riske atabiliyor; bu da Jenkins gibi kritik altyapı bileşenlerinin güvenlik yamalarının önceliklendirilmesi gerektiğini gösteriyor. #SiberGüvenlik #Jenkins #CI_CD
Post summary
The article discloses that CVE‑2026‑53435 is a deserialization flaw in Jenkins’ XStream component, allowing low‑privilege users to upload arbitrary Java classes via a crafted config.xml, leading to remote code execution.
0000039
41 followersView on X
Alexander Leonov@leonov_av58d
Active Exploitation
🚨 August Linux Patch Wednesday: record 3,060 vulns (+52%); 3 exploited in the wild - Jenkins RCE CVE-2026-53435, WordPress CodeInj CVE-2026-60137, SPIP RCE CVE-2026-77647 + 127 with public exploits. #LinuxPatchWednesday #Linux #Vulristics ➡️ https://avleonov.com/2026/08/26/i138-august-linux-patch-wednesday/ https://t.co/Bx0OY5KDxl
Post summary
The tweet reports that three specific CVEs—Jenkins RCE (CVE‑2026‑53435), WordPress code injection (CVE‑2026‑60137), and SPIP RCE (CVE‑2026‑77647)—were actively exploited in the wild, with 127 additional vulnerabilities confirmed to have public exploits; no patch or PoC details are provided.
0000086
1.0K followersView on X
IntegSec@integ_sec110d
General
CVE-2026-53435: Jenkins Deserialization Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04nL-dq0
Post summary
The post presents a general overview of CVE‑2026‑53435, describing it as a Jenkins deserialization flaw, without evidence of PoC, exploit code, active exploitation, or patch availability.
0000035
31 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	jenkins	jenkins	-	-	-
App	jenkins	jenkins	-	-	-

Explore more

Back to dashboard jenkins CVEs jenkins vulnerabilities

What researchers are saying

CVE-2026-53435

Rishi[verified]@rxeriumActive Exploitation

CVE-2026-53435 is a high‑severity Jenkins deserialization flaw (CVSS 8.8) that is actively exploited per DefusedCyber, and available patches are referenced in the vendor advisory.

dbugs[verified]@ptdbugsExploit

The post announces a Jenkins vulnerability with detailed technical information and provides a link to functional exploit code, but does not indicate active exploitation or a patch.

kokumօtօ[verified]@__kokumotoActive Exploitation

Jenkins CVE-2026-53435 is actively exploited in the wild, as evidenced by honeypot observations occurring just hours after disclosure.

The CyberSec Guru[verified]@thecybersecguruPoC

The tweet announces a proof‑of‑concept for CVE-2026-53435, a Jenkins deserialization flaw, with further technical details implied in the linked article.

Lyrie.ai[verified]@lyrie_aiGeneral

The post lists a zero‑day CVE (CVE‑2026‑53435) for Jenkins but offers no technical details, PoC, or exploitation evidence.

Lyrie.ai[verified]@lyrie_aiGeneral

The text simply announces the existence of a new 0day CVE (CVE-2026-53435) for Jenkins without providing technical, exploit, patch, or deployment details.

Lyrie.ai[verified]@lyrie_aiDisclosure

The tweet announces a new CVE against Jenkins with a CVSS score but provides no exploit details or mitigation, making it a straightforward disclosure.

Lyrie.ai[verified]@lyrie_aiDisclosure

The text announces CVE-2026-53435 for Jenkins, describing that attackers can deserialize arbitrary types in affected versions; it contains no evidence of exploitation, PoC, or patch information.