Jenkins Remoting implements deserialization of data from agent nodes. In versions 3384.v60d89463d9e0 and older, the JEP-200 class filter, which normally blocks deserialization of untrusted classes, is not applied to classes that are resolved through a fallback path. This oversight lets agent code or attackers who possess Agent/Connect rights load and instantiate any class from the Jenkins core classpath during deserialization. The result is that an attacker can trigger arbitrary code execution on the Jenkins controller, potentially compromising the entire CI/CD environment.

Systems running Jenkins core version 2.575 or earlier, or the LTS 2.568.1 build and earlier, are affected. The vulnerability also exists in the Remoting component in releases 3384.v60d89463d9e0 and older, except the 3355.3357.v931d3c992987 snapshot. These versions are bundled in standard Jenkins distributions, so many installations may be impacted.

The flaw has a high potential for remote code execution, but its exploitation requires an agent with legitimate connection rights or an attacker that can execute code on an agent node. Because the exploit hinges on the presence of Agent/Connect permissions, attackers that do not already have such access need to compromise an agent or gain the necessary permissions. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog; however the lack of a filter and the ability to load arbitrary core classes suggests a severe impact if the attacker’s conditions are met.