Skip to content

Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

Jenkins: actively exploited vulnerabilities

6 vulnerabilities in Jenkins products (Core, Plugins) are in CISA’s catalog of exploited vulnerabilities. Last added: October 2, 2025.

Jenkins security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

1 vulnerability added in the last 12 months
6 exploited vulnerabilities in the catalog, in total
0 added in the last 30 days

By category

Add just one Jenkins category to your radar, or open its page.

Development and CI/CD 6 vulnerabilities

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Core 4 vulnerabilities · Development and CI/CD
Plugins 2 vulnerabilities · Development and CI/CD

Name used by CISA: Jenkins. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Jenkins list.

Rank 1Jenkins Core
CVE-2017-1000353
CVE from 2017, added in 2025
Jenkins Remote Code Execution Vulnerability
Added in the last 12 months: ranked by severity.
Added
Oct 2, 2025
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 2Jenkins Plugins
CVE-2019-1003029
CVE from 2019, added in 2022
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
Added more than a year ago: ranked by severity.
Added
Apr 25, 2022
CISA deadline
21 days
CVSS severity
9.9 (critical)
Rank 3Jenkins Plugins
CVE-2019-1003030
CVE from 2019, added in 2022
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 25, 2022
CISA deadline
21 days
CVSS severity
9.9 (critical)
Rank 4Jenkins Core
CVE-2024-23897
Ransomware
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Aug 19, 2024
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 5Jenkins Core
CVE-2018-1000861
CVE from 2018, added in 2022
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
Added more than a year ago: ranked by severity.
Added
Feb 10, 2022
CISA deadline
181 days
CVSS severity
9.8 (critical)
Rank 6Jenkins Core
CVE-2015-5317
CVE from 2015, added in 2023
Jenkins User Interface (UI) Information Disclosure Vulnerability
Added more than a year ago: ranked by severity.
Added
May 12, 2023
CISA deadline
21 days
CVSS severity
7.5 (high)

Get new Jenkins vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.