The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers…
Priority CRITICAL 86CWE-90Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
Why it matters now
EPSS 0.96943 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial org.jenkins-ci.main:jenkins-core (Maven): 2.32, 2.19.3Red Hat: 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.jenkins-ci.main:jenkins-core (Maven) | 2.20 to before 2.32 | 2.32 | Patch available | GHSA-2x9h-h3c4-wqqh |
| — | org.jenkins-ci.main:jenkins-core (Maven) | before 2.19.3 | 2.19.3 | Patch available | GHSA-2x9h-h3c4-wqqh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.20 to before 2.32 Fixed in 2.32 Patch available GHSA-2x9h-h3c4-wqqh
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.19.3 Fixed in 2.19.3 Patch available GHSA-2x9h-h3c4-wqqh
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* | up to 2.19.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* | up to 2.31 | Vulnerable | Jenkins |
| cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:* | 25 | Vulnerable | Fedoraproject |
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions up to 2.19.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* Versions up to 2.31 Vulnerable ·Jenkins
- cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:* Versions 25 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-2x9h-h3c4-wqqh org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.32 Advisory →
- Fix · GHSA-2x9h-h3c4-wqqh org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.19.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Enterprise 2 | Affected | — |
| Red Hat OpenShift Enterprise 3 | Affected | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2016-9299
- 2026-10-03 Alias added: GHSA-2x9h-h3c4-wqqh
References
Exploit 1
Advisory 7
- [oss-security] 20161113 CVE request: Jenkins remote code execution vulnerability
- FEDORA-2016-368780879d
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16
- http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition
- https://www.cloudbees.com/jenkins-security-advisory-2016-11-16
- [oss-security] 20161114 Re: CVE request: Jenkins remote code execution vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2016-9299
Other 12
- [jenkinsci-advisories] 20161111 Re: Unauthenticated remote code execution vulnerability in Jenkins
- [jenkinsci-advisories] 20161111 Unauthenticated remote code execution vulnerability in Jenkins
- https://github.com/jenkinsci/jenkins/commit/6078dd7aa097baf3402de9d5279f6053926a1ea7
- https://github.com/jenkinsci/jenkins/commit/ce8a2d51a5ee9ca12d0a75659b06161888e0a1bf
- https://github.com/jenkinsci/jenkins/commit/d84d9a2ad3825f316f805a18b3654b0803e0d7fc
- https://github.com/jenkinsci/jenkins/commit/f574224cae5ffde2bc4c996305c0dcf5ab135440
- https://github.com/jenkinsci/jenkins/commit/fde9c42fe05ac925a904b6c09a81d497d0e6ccea
- https://github.com/jenkinsci/jenkins
- https://groups.google.com/forum/#!original/jenkinsci-advisories/-fc-w9tNEJE/GRvEzWoJBgAJ
- https://groups.google.com/forum/#!original/jenkinsci-advisories/-fc-w9tNEJE/LZ7EOS0fBgAJ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6
- https://www.exploit-db.com/exploits/44642
Sources
- CVE-2016-9299 · CVE Program
- CVE-2016-9299 · NVD
- FIRST EPSS
- GHSA-2x9h-h3c4-wqqh · GitHub Advisory Database · CC BY 4.0
- CVE-2016-9299 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences