Jenkins · Jenkins Stapler Web Framework

CVE-2018-1000861

Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 98%

What it is

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

CISA: A code execution vulnerability exists in the Stapler web framework used by Jenkins

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: August 10, 2022

access.redhat.com/errata/RHBA-2019:0024

Added to the CISA list: February 10, 2022
Published: December 10, 2018
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 98% in the top 0.1% of all known vulnerabilities
Weakness: CWE-502
More details: NVD · CVE.org · CISA

All references (4)

More exploited flaws from Jenkins

Added	Vulnerability	Product	Severity	Attack chance
Oct 2, 2025	Remote Code ExecutionCVE-2017-1000353	Jenkins	Critical 9.8	99.7%
Aug 19, 2024	Command Line Interface (CLI) Path TraversalCVE-2024-23897used by ransomware	Jenkins Command Line Interface (CLI)	Critical 9.8	>99.9%
May 12, 2023	User Interface (UI) Information DisclosureCVE-2015-5317	Jenkins User Interface (UI)	High 7.5	23%
Apr 25, 2022	Sandbox BypassCVE-2019-1003029	Script Security Plugin	Critical 9.9	74%
Mar 25, 2022	Remote Code ExecutionCVE-2019-1003030	Matrix Project Plugin	Critical 9.9	97%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.