CVE-2024-23897: Jenkins CLI parser arbitrary file read via @ path expansion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, confirmed exploitation in the wild, KEV listing with ransomware use, and near-maximum EPSS make this an urgent patch.

What it is

Jenkins 2.441 and earlier, and LTS 2.426.2 and earlier, fails to disable a CLI command parser feature that replaces an '@' character followed by a file path with that file's contents. This lets an unauthenticated attacker read arbitrary files on the Jenkins controller file system, which can expose credentials and keys used to pivot further into the environment.

Impact

An attacker gains unauthenticated read access to arbitrary files on the Jenkins controller, including secrets and configuration that can enable lateral movement or full compromise. CISA KEV lists known ransomware campaign use, so downstream impact can extend to broader network compromise.

Attack surface

Reached over the network through the Jenkins CLI command parser; the CVSS vector shows no privileges and no user interaction required. Any network-reachable Jenkins controller with the CLI exposed is a candidate.

Exploitation

CISA KEV lists it as exploited in the wild with known ransomware campaign use, and EPSS is near 1.0 (0.99999, 99.995th percentile). Multiple references carry Exploit tags, indicating public exploit material exists.

What to do

• Upgrade Jenkins to a fixed version (2.442 or later, or LTS 2.426.3 or later) as the primary action.
• If immediate upgrade is not possible, disable CLI access over HTTP or restrict the CLI port to trusted networks per the vendor advisory.
• Remove or rotate any credentials, keys, or secrets stored on the controller that may have been exposed.
• Restrict network access to the Jenkins controller and CLI to trusted sources only.
• Monitor the vendor advisory and CISA KEV entry for updated guidance.

Detection

• Review Jenkins controller and CLI access logs for requests using '@' followed by file paths in CLI arguments.
• Alert on unexpected reads of sensitive files such as credentials.xml, secrets files, or SSH keys on the controller.
• Monitor for CLI connections from unusual or external source IPs.
• Correlate Jenkins controller activity with outbound connections or new process execution that could indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.