CVE-2015-8103: Jenkins CLI Java deserialization allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS 3.1 score of 9.8, high EPSS and public exploit code.

What it is

Jenkins before 1.638 and LTS before 1.625.2 deserializes untrusted Java objects in its CLI subsystem, and the bundled commons-collections library makes a gadget chain reachable. An unauthenticated network attacker can therefore run arbitrary code on the Jenkins controller, which typically holds credentials and deployment keys.

Impact

Full remote code execution as the Jenkins process, leading to compromise of the controller, its stored secrets and any build agents or deployment targets it can reach.

Attack surface

Reachable over the network through the Jenkins CLI subsystem; the CVSS vector shows no privileges and no user interaction required. The description does not state which port or protocol the CLI listener uses.

Exploitation

Not listed in CISA KEV, but EPSS is 0.867 (99.7th percentile) and multiple references are tagged Exploit, including Exploit-DB 38983 and a vendor advisory on mitigating an unauthenticated RCE 0-day. Public exploit code exists.

What to do

• Upgrade Jenkins to 1.638 or later, or LTS to 1.625.2 or later, and apply the vendor security advisory 2015-11-11 guidance.
• If immediate upgrade is not possible, disable or firewall the Jenkins CLI subsystem and restrict access to the controller to trusted networks.
• Remove or replace the vulnerable commons-collections jar where the vendor guidance permits, and apply Red Hat errata RHSA-2016:0070 / RHSA-2016-0489 for affected OpenShift components.
• Rotate credentials, API tokens and SSH keys stored in Jenkins after any suspected exposure.
• Restrict outbound network access from the Jenkins controller to limit post-exploitation movement.

Detection

• Monitor Jenkins logs and network traffic for CLI/RMI connections from unexpected sources, especially outside maintenance windows.
• Alert on unexpected child processes spawned by the Jenkins Java process, such as shells or download utilities.
• Hunt for known ysoserial or commons-collections gadget payload patterns in traffic to the Jenkins CLI endpoint.
• Audit Jenkins for new or modified jobs, credentials and plugins that could indicate post-exploitation persistence.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.