Loading story…
Trend Micro reported that CVE-2024-23897 in Jenkins stems from the args4j command parser and can let attackers read arbitrary files from affected servers. The flaw impacts the Jenkins CLI and can expose sensitive data such as configuration files, credentials, and other secrets that may be stored on the controller, creating a direct path to broader compromise.
The report warns that leaked files can be used to escalate access and, in some environments, lead to remote code execution on Jenkins infrastructure. Because Jenkins often sits at the center of software build and deployment pipelines, successful exploitation could give attackers access to source code, build secrets, and downstream production environments, raising the risk of supply-chain compromise.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
Trend Micro published research on CVE-2024-23897, an Args4j-related Jenkins vulnerability that can expose files and put code at risk. No earlier discrete events are described in the provided reference content.
A critical Jenkins vulnerability, CVE-2024-23897, was publicly reported as exposing servers to remote code execution and file disclosure risks. The disclosure included guidance for administrators to patch affected Jenkins instances as soon as possible.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jenkins, a widely used open-source automation server, has released critical security updates to address multiple high-severity vulnerabilities that could expose CI/CD pipelines to significant risks. The most severe flaw, tracked as CVE-2025-67635, affects Jenkins versions 2.540 and earlier (including LTS 2.528.2 and earlier) and allows unauthenticated attackers to trigger denial-of-service (DoS) attacks via the HTTP-based command-line interface. This vulnerability arises from improper connection handling, where corrupted HTTP CLI streams are not properly closed, enabling attackers to exhaust server resources and render Jenkins instances unresponsive. Organizations relying on Jenkins are urged to upgrade to version 2.541 or LTS 2.528.3 to mitigate this risk. In addition to the DoS vulnerability, another high-severity issue, CVE-2025-67641, was identified in the Jenkins Coverage Plugin. This flaw allows attackers with "Item/Configure" permissions to exploit coverage reports for stored cross-site scripting (XSS) attacks by submitting malicious JavaScript via the REST API. If an administrator views a compromised report, the script executes, potentially leading to session hijacking. Both vulnerabilities have been addressed in the latest Jenkins security updates, and immediate patching is recommended to protect against exploitation.
Jun 29, 2026
Jenkins published a security advisory covering multiple vulnerabilities in widely used plugins, with fixes released for affected versions. The disclosed issues span **missing permission checks**, **unsafe deserialization**, **stored cross-site scripting**, and an **open redirect**, affecting plugins including **Script Security**, **Credentials Binding**, **Matrix Authorization Strategy**, **GitHub Branch Source**, **GitHub**, **HTML Publisher**, and **Microsoft Entra ID**. The most serious issue is an **arbitrary file write** flaw that can lead to **remote code execution**, while other bugs could let attackers abuse low-privilege access such as `Overall/Read`, `Item/Configure`, or the ability to supply credentials to a job. Jenkins said the advisory includes severity ratings, attribution, and patched plugin versions, and urged administrators to update impacted plugins to the fixed releases.
Jun 29, 2026
Jenkins released security updates for multiple vulnerabilities in its CI/CD automation platform, including six high-severity flaws involving **remote code execution**, security-restriction bypass, tampering, and spoofing. Jenkins core versions 2.579 and earlier, and LTS versions 2.568.2 and earlier, are affected; fixed releases are **2.580** and **2.568.3**, respectively. The advisory also identifies vulnerabilities in `update-center2` and numerous plugins, including Allure, GitLab, LDAP, SAML, and Script Security. The Canadian Centre for Cyber Security, Italy's ACN/CSIRT, and bjCSIRT urged administrators to review the Jenkins security bulletin, update core installations and affected plugins, and prioritize exposed or internet-accessible Jenkins servers.
Sep 4, 2026