Skip to content
Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

Jenkins: actively exploited vulnerabilities

6 vulnerabilities in Jenkins products (Core, Plugins) are in CISA’s catalog of exploited vulnerabilities. Last added: October 2, 2025.

Jenkins security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one Jenkins category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Follow a single Jenkins product (Core, Plugins…) rather than the whole brand.

  • Core4 vulnerabilities, Development and CI/CD
  • Plugins2 vulnerabilities, Development and CI/CD

Name used by CISA: Jenkins. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Jenkins list.

  1. Rank 1

    Jenkins PluginsCVE-2019-1003029

    Jenkins Script Security Plugin Sandbox Bypass Vulnerability

    CVE from 2019, added in 2022

    CVSS severity 9.9critical

    Added Apr 25, 2022

  2. Rank 2

    Jenkins PluginsCVE-2019-1003030

    Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

    CVE from 2019, added in 2022

    CVSS severity 9.9critical

    Added Mar 25, 2022

  3. Rank 3

    Jenkins CoreCVE-2017-1000353

    Jenkins Remote Code Execution Vulnerability

    CVE from 2017, added in 2025

    CVSS severity 9.8critical

    Added Oct 2, 2025

  4. Rank 4

    Jenkins CoreCVE-2024-23897

    Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Aug 19, 2024

  5. Rank 5

    Jenkins CoreCVE-2018-1000861

    Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

    CVE from 2018, added in 2022

    CVSS severity 9.8critical

    Added Feb 10, 2022

  6. Rank 6

    Jenkins CoreCVE-2015-5317

    Jenkins User Interface (UI) Information Disclosure Vulnerability

    CVE from 2015, added in 2023

    CVSS severity 7.5high

    Added May 12, 2023

Follow and verify

Get new Jenkins vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.