CVE-2018-1000861 Jenkins
| Affected software | Jenkins |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Fixed in | 2.138.4, 2.154 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 10 Dec 2018 |
| Updated | 17 Jun 2026 |
Description
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2022-02-10 · remediation due 2022-08-10 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 8 citations · honeypot sightings · 3 exploits · earliest 2020-06-24.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 5 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2019-04-24.
- EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2018-1000861 in VulnCheck (free account), which lists 3 more citations not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 84 days | 2024-10-17 to 2026-11-09 |
| Reported exploitation | unit42.paloaltonetworks.com | /lucifer-new-cryptojacking-and-ddos-hybrid-malware | 2020-06-24 |
| Reported exploitation | research.checkpoint.com | /2020/rudeminer-blacksquid-and-lucifer-walk-into-a-bar | 2020-09-15 |
| Reported exploitation | cujo.com | /the-sysrv-botnet-and-how-it-evolved | 2021-09-22 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2022-02-10 |
| Reported exploitation | botconf.eu | /wp-content/uploads/2022/05/Botconf2022-24-PalotayZsigovits.pdf | 2022-04-27 |
| Exploit reference | VulnCheck XDB 456a6baaa89d | Exploit type: initial-access | 2019-04-24 |
| Exploit reference | VulnCheck XDB 0fa5309130e4 | Exploit type: initial-access | 2023-09-13 |
| Exploit reference | VulnCheck XDB f9c4ef09f3ab | Exploit type: initial-access | 2026-10-08 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | A C# module to detect if a Jenkins server is vulnerable to the RCE vulnerability found in CVE-2019-1003000 (chained with CVE-2018-1000861 for pre-auth RCE) | 4 | 2019-04-24 |
| GitHub PoC | Vulhub jenkins/CVE-2018-1000861: Jenkins Stapler unauthenticated RCE, run with Isoloom | 2026-10-08 | |
| GitHub PoC | CVE-2018-1000861 Exploit | 2023-09-13 | |
| Nuclei | Jenkins - Remote Command Injection | ||
| Metasploit | Jenkins ACL Bypass and Metaprogramming RCE (excellent rank) |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available security rule
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Protected by Waratek. |
How to mitigate CVE-2018-1000861
Upgrade Jenkins to a release that fixes it: 2.138.4 or 2.154. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 10.0 | none | AV:N/AC:L/Au:N/C:C/I:C/A:C |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.jenkins-ci.main:jenkins-core |
0 | 2.138.4 |
unbounded |
org.jenkins-ci.main:jenkins-core |
2.140 | 2.154 |
unbounded |
Products and versions
3 products, 5 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | jenkins | jenkins | generic | ≤ 2.138.3 · ≤ 2.153 |
| osv | org.jenkins-ci.main | jenkins-core | generic | ＜ 2.138.4 · ≥ 2.140 and ＜ 2.154 |
| nvd | redhat | openshift container platform | generic | 3.11 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Products:** STAPLER WEB FRAMEWORK
References
Timeline
Timeline
| Published | 2018-12-10 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2020-06-24 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2022-02-10 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-09 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |