Critical Jenkins Vulnerability Let Attackers Execute Remote Code

A critical Jenkins CLI parser vulnerability (CVE-2024-23897, CVSS 9.8) in versions 2.441 and earlier enables arbitrary file reads and can lead to remote code execution; attackers may read cryptographic keys, decrypt secrets, delete items, and download Java heap dumps. The report also lists additional related CVEs, notes a fix in Jenkins 2.442/LTS 2.426.3 that disables the parser, and recommends updating or blocking CLI access as a workaround.