Jenkins known exploited vulnerabilities
CISA's Known Exploited Vulnerabilities catalog lists 6 Jenkins vulnerabilities: 0 added in the last 365 days, 5 rated critical (CVSS 9 or higher), and 1 with known ransomware use. The most recent was added Oct 2, 2025.
RSS feed for Jenkins exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant
| Added to KEV | CVE | Vulnerability | CVSS | EPSS | Federal due date | Ransomware use |
|---|---|---|---|---|---|---|
| 2025-10-02 | CVE-2017-1000353 | Jenkins Remote Code Execution Vulnerability | 9.8 (v3.1) | 99.7% | 2025-10-23 | Unknown |
| 2024-08-19 | CVE-2024-23897 | Jenkins Command Line Interface (CLI) Path Traversal Vulnerability | 9.8 (v3.1) | >99.9% | 2024-09-09 | Known |
| 2023-05-12 | CVE-2015-5317 | Jenkins User Interface (UI) Information Disclosure Vulnerability | 7.5 (v3.1) | 23.0% | 2023-06-02 | Unknown |
| 2022-04-25 | CVE-2019-1003029 | Jenkins Script Security Plugin Sandbox Bypass Vulnerability | 9.9 (v3.1) | 74.4% | 2022-05-16 | Unknown |
| 2022-03-25 | CVE-2019-1003030 | Jenkins Matrix Project Plugin Remote Code Execution Vulnerability | 9.9 (v3.1) | 97.1% | 2022-04-15 | Unknown |
| 2022-02-10 | CVE-2018-1000861 | Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability | 9.8 (v3.1) | 98.3% | 2022-08-10 | Unknown |