CVE-2026-53435: Jenkins config.xml deserialization allows user impersonation and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability, low privileges required, and full confidentiality, integrity, and availability impact, plus a very high EPSS score, though no confirmed in-the-wild exploitation is listed.

What it is

Jenkins 2.567 and earlier, and LTS 2.555.2 and earlier, deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission. Because the deserialized objects can handle HTTP requests afterward, an attacker can impersonate any user and act on their behalf. This reaches the Script Console for arbitrary code execution or allows reading arbitrary files from the Jenkins controller.

Impact

An attacker gains the ability to send HTTP requests as any user, including administrators, and can escalate to arbitrary code execution via the Script Console or read arbitrary files on the controller. This effectively yields full control of the Jenkins instance and its secrets.

Attack surface

Reached over the network via an attacker-controlled config.xml submission; the CVSS vector indicates network access with low privileges required and no user interaction. No authentication bypass is implied, but only low-privileged access is needed to submit the crafted configuration.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented; EPSS is very high at 0.531 (99th percentile), and the only tagged reference is the vendor advisory, so no public exploit code is confirmed in this record.

What to do

• Upgrade Jenkins to a version after 2.567 or LTS after 2.555.2 per the vendor advisory SECURITY-3707.
• Apply the referenced Red Hat errata (RHSA-2026:60239 through RHSA-2026:60259) for packaged deployments.
• Restrict who can submit or modify config.xml and limit Script Console access to trusted administrators.
• Run the Jenkins controller with least privilege and isolate it from sensitive internal networks and file shares.
• Monitor and audit plugin and core versions for the fixed releases.

Detection

• Alert on config.xml submissions or modifications from unexpected users or IP addresses.
• Monitor Jenkins logs for deserialization errors or unexpected object types during configuration handling.
• Detect Script Console usage and unusual HTTP requests attributed to other users' sessions.
• Watch for anomalous file reads on the Jenkins controller host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.