CISA warns of Jenkins RCE bug exploited in ransomware attacks

CVE-2024-23897 is a critical Jenkins flaw in the args4j CLI parser (expandAtFiles) enabling unauthenticated file reads and potential RCE; multiple PoCs and active exploitation have been observed, thousands of exposed Jenkins instances remain unpatched, and threat actors including IntelBroker and RansomEXX have used the vulnerability in breaches and ransomware operations, prompting CISA to add it to the Known Exploited Vulnerabilities catalog and mandate remediation for federal agencies.