Critical 9.8Known exploited (CISA KEV)Published Jan 24, 2024

CVE-2024-23897Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents,…

Updated under an hour ago (2026-10-19 10:23 UTC)

Does this affect you?

It affects Jenkins Project Jenkins and 1 other product. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Aug 19, 2024; federal agencies had to remediate by Sep 9, 2024, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Jenkins Project Jenkins

Exploited in the last 30 days

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-27
Known exploited: Added to CISA KEV Aug 19, 2024; federal remediation due Sep 9, 2024; known ransomware useApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 100.00% (percentile 100)
Assigned by: jenkins
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Jenkins Project Jenkins jenkins_project:jenkins (from the name)	before 1.606 not affected; from 2.442 not affected; 2.426.3 builds before 2.426.* not affected; 2.440.1 builds before 2.440.* not affected	CNA record
jenkins jenkins jenkins:jenkins	before 1.606 not affected; from 2.442 not affected; from 2.426.3 before 2.427 not affected; from 2.440.1 before 2.441 not affected	CISA ADP
jenkins jenkins jenkins:jenkins	before 2.426.3; before 2.442	NVD

References

https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314vendor-advisory
https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/exploit, press/media-coverage
http://www.openwall.com/lists/oss-security/2024/01/24/6mailing-list
http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.htmlthird-party-advisory, vdb-entry
http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.htmlexploit, third-party-advisory, vdb-entry
https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1exploit, third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.