PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-1000353 Jenkins CVE debrief

CVE-2017-1000353 is a Jenkins remote code execution vulnerability that CISA has placed in the Known Exploited Vulnerabilities (KEV) catalog. The supplied CISA metadata indicates the vulnerability is known to be exploited in the wild and sets a remediation due date of 2025-10-23. Organizations running Jenkins should treat this as a high-priority exposure and follow vendor guidance immediately.

Vendor
Jenkins
Product
Jenkins
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2025-10-02
Original CVE updated
2025-10-02
Advisory published
2025-10-02
Advisory updated
2025-10-02

Who should care

Security teams, DevOps/platform engineers, and administrators responsible for Jenkins instances should prioritize this CVE, especially where Jenkins is internet-facing, broadly reachable inside the network, or used in build and deployment pipelines.

Technical summary

The supplied source corpus identifies CVE-2017-1000353 as a Jenkins remote code execution issue and confirms it is in CISA’s KEV catalog. The available authoritative metadata does not include technical root-cause details, affected version ranges, or exploit mechanics, so the safest evidence-based summary is that it enables remote code execution and is considered actively exploited. CISA’s required action is to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Defensive priority

Critical for exposed Jenkins deployments; treat as urgent remediation because CISA lists it as known exploited and has assigned a due date.

Recommended defensive actions

  • Check whether any Jenkins instances in your environment are exposed or reachable by untrusted users.
  • Review the Jenkins security advisory referenced by CISA and apply the vendor’s mitigations as soon as possible.
  • If mitigations are unavailable or cannot be applied safely, discontinue use or remove the affected deployment path.
  • Track remediation against CISA’s KEV due date of 2025-10-23 for any in-scope systems.
  • For cloud-hosted usage, follow applicable BOD 22-01 guidance referenced by CISA.

Evidence notes

This debrief is based on the supplied CISA KEV metadata, which identifies vendorProject=Jenkins, product=Jenkins, vulnerabilityName=Jenkins Remote Code Execution Vulnerability, dateAdded=2025-10-02, dueDate=2025-10-23, and knownRansomwareCampaignUse=Unknown. CISA’s notes reference the Jenkins security advisory at https://www.jenkins.io/security/advisory/2017-04-26/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2017-1000353. The source corpus does not provide CVSS, affected versions, exploit details, or remediation specifics beyond CISA’s required action language.

Official resources

Publicly documented vulnerability referenced by CISA in KEV; CISA’s notes point to a Jenkins security advisory dated 2017-04-26.