Jenkins Remote Code Execution via Java SignedObject Deserialization

Historical catalog analysis: CISA added this entry on October 02, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2017-1000353 is a remote code execution (RCE) vulnerability affecting Jenkins. The flaw exists in how the remoting-based Jenkins CLI handles data. Specifically, an attacker can transfer a serialized Java SignedObject to the CLI; this object is then deserialized using a new ObjectInputStream. This process allows the attacker to bypass existing blocklist-based protection mechanisms designed to prevent unsafe deserialization.

Exposure and applicability

This vulnerability applies to Jenkins environments utilizing the remoting-based CLI. The primary exposure path is the transfer of malicious serialized objects to the CLI interface. Organizations using Jenkins for continuous integration and delivery (CI/CD) should identify all active instances where the CLI is enabled and accessible, as this represents the primary attack surface for this specific bypass.

Remediation priorities

Based on the technical nature of the deserialization bypass, we analyze the following prioritization for defenders:

1. Immediate Mitigation Application: Priority should be given to applying vendor-supplied mitigations. Because this vulnerability bypasses blocklists, relying on existing filters is insufficient.
2. Cloud Service Alignment: For organizations utilizing Jenkins via cloud providers, remediation should align with BOD 22-01 guidance to ensure the underlying infrastructure and service configurations are addressed.
3. Asset Decommissioning: In scenarios where vendor mitigations cannot be applied or verified, the product should be discontinued to eliminate the exposure entirely.

How to validate remediation

Verification must go beyond a simple version check, as configuration states can influence exploitability. To prove that exposure has been reduced, defenders should:

• Verify Mitigation Deployment: Confirm that the specific vendor-recommended patches or configuration changes are active across all Jenkins controllers and agents.
• Test CLI Accessibility: Validate whether the remoting-based CLI is restricted to authorized networks or disabled if not required for business operations.
• Configuration Audit: Ensure that any updated blocklists or deserialization filters provided by the vendor are correctly loaded into the runtime environment.

Limits and open questions

While the mechanism of the bypass (using SignedObject) is identified, there are remaining uncertainties. The source does not specify if this vulnerability has been leveraged in known ransomware campaigns. Additionally, while CISA has established a remediation deadline for federal agencies, this date serves as a risk indicator rather than a legal requirement for private sector entities. Residual risk remains if the CLI is left exposed to untrusted networks, even after patching, as deserialization flaws often have complex dependencies on the Java runtime environment.

Source and editorial note

CVE-2017-1000353: Jenkins Remote Code Execution Vulnerability · Source date: October 02, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: October 05, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 01, 2026 at 00:56 UTC.

Request a Vulnerability Assessment