ZeusQA
Start free

Known exploited vulnerabilities

Jenkins vulnerabilities attackers have used

Every Jenkins vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 6 Jenkins vulnerabilities as exploited in the wild, 0 of them added in the last 12 months and 1 used in ransomware campaigns. The most recent is CVE-2017-1000353, added Oct 2, 2025. Jenkins has the most entries (1).

In KEV, all time
6
Added, last 12 months
0
Used in ransomware
1
New CVEs this week
0

By product

Jenkins (1), Jenkins Command Line Interface (CLI) (1), Jenkins Stapler Web Framework (1), Jenkins User Interface (UI) (1), Matrix Project Plugin (1), Script Security Plugin (1).

Every Jenkins entry in CISA KEV

  1. CVE-2017-1000353

    Added · due

    Jenkins Remote Code Execution Vulnerability

    Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new…

  2. CVE-2024-23897

    RansomwareAdded · due

    Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

    Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.

  3. CVE-2015-5317

    Added · due

    Jenkins User Interface (UI) Information Disclosure Vulnerability

    Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.

  4. CVE-2019-1003029

    Added · due

    Jenkins Script Security Plugin Sandbox Bypass Vulnerability

    Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.

  5. CVE-2019-1003030

    Added · due

    Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

    Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.

  6. CVE-2018-1000861

    Added · due

    Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

    A code execution vulnerability exists in the Stapler web framework used by Jenkins

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works