CVE-2026-53435

It is possible for an attacker to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an config.xml submission, which allows them to handle HTTP requests afterwards. Attackers need to have at least certain permissions to exploit this vulnerability. When exploited attackers can impersonate any user and send HTTP requests on their behalf, which also includes running arbitrary code using the script console.

EPSS 53.13% · 99.0th percentile