tag

Xstream

High (advisory also describes user impersonation and Script Console RCE via the same primitive; this PoC demonstrates file-read impact only)

Jenkins ClassFilter Deserialization Bypass → Arbitrary File Read — CVE-2026-53435

CVE-2026-53435 (Jenkins SECURITY-3707)· Jenkins (core), View configuration (config.xml) deserialization path patched