Critical RCE Vulnerability in Jenkins Exploited in the Wild

A critical remote code execution vulnerability (CVE-2026-53435) has been disclosed in Jenkins versions 2.567 and earlier (including LTS 2.555.2 and earlier). The flaw stems from insecure deserialization of an attacker-controlled config.xml, enabling impersonation and arbitrary code execution by unauthenticated or low-privileged actors. Active exploitation has been confirmed; organizations are urged to patch immediately and increase monitoring as advised by authorities including the Centre for Cybersecurity Belgium.