Jenkins releases 2.567 and earlier, and the LTS release 2.555.2 and earlier versions allow an attacker to submit a crafted config.xml that is deserialized into arbitrary core or plugin types. This flaw, identified as a deserialization vulnerability (CWE‑502), enables the attacker to impersonate any Jenkins user, send HTTP requests on the user’s behalf, exploit the Script Console to run the controller, thereby compromising confidentiality, integrity, and availability of the Jenkins instance.

The vulnerability affects Jenkins Project’s Jenkins software, specifically version 2.567 and all earlier 2.x releases, as well as the LTS release 2.555.2 and all preceding LTS versions.

The flaw can be triggered by providing a config.xml file, which means that an attacker who can reach the Jenkins UI or API can exploit it remotely without any additional credentials. The likely attack vector is thus the submission of an attacker‑controlled configuration file. Based on the description, it is inferred that the vulnerability can be leveraged to execute arbitrary code through the Script Console or to read sensitive files. The CVSS score of 8.8 indicates high severity. EPSS score of 14% indicates a moderate exploitation probability, and the issue is not listed in CISA KEV, but the combination of remote activation and the potential for full code execution keeps the risk high, especially against installations that have not applied the available fix.