Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-53435
By Roy Kalfon |
15 June 2026
CVE-2026-53435 – Jenkins config.xml deserialization allows request handler injection and user impersonation
In Jenkins 2.567 and earlier and LTS 2.555.2 and earlier, attackers can submit an attacker-controlled config.xml that triggers deserialization of arbitrary types from core/plugins, creating objects that can handle HTTP requests. This enables impersonation of any user and HTTP actions as them, including Script Console code execution or reading arbitrary controller files. Upgrade to 2.568/LTS 2.555.3.