CVE-2016-0792 Public exploit EPSS 83.3%

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Summary

Jenkins (versions before 1.650 and LTS before 1.642.2) contains a flaw in multiple unspecified API endpoints that handle serialized data via XStream and groovy.util.Expando. An authenticated remote user can exploit it by supplying crafted serialized data in an XML file to execute arbitrary code, with the attack relying on valid user credentials rather than anonymous access.

Heading is the official description · CVE.org

Breakdown

24.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Metasploit) was available 43 days before disclosure.

Public exploit codeMetasploit24 Feb 201643 days before
Disclosed7 Apr 2016day 0

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.main:jenkins-core.

Mavenorg.jenkins-ci.main:jenkins-coreGHSA-45rg-g72w-r393

Upgrade to 1.650

Still affected on this line by CVE-2016-9299 (fixed in 2.19.3, a newer line); CVE-2017-1000353 (fixed in 2.46.2, a newer line); CVE-2018-1000861 (fixed in 2.138.4, a newer line); CVE-2018-1999002 (fixed in 2.121.2, a newer line); CVE-2019-10405 (fixed in 2.176.4, a newer line); CVE-2020-2230 (fixed in 2.235.4, a newer line); CVE-2024-23897 (fixed in 2.426.3, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).

Set the version to 1.650 or later in your pom.xml or build.gradle.

The first fix for CVE-2016-0792.

Affected versions, by release line

If you run	Upgrade to
1.643 up to 1.650	1.650
All versions before 1.642.2 Still affected on this line by CVE-2016-9299 (fixed in 2.19.3, a newer line); CVE-2017-1000353 (fixed in 2.46.2, a newer line); CVE-2018-1000861 (fixed in 2.138.4, a newer line); CVE-2018-1999002 (fixed in 2.121.2, a newer line); CVE-2019-10405 (fixed in 2.176.4, a newer line); CVE-2020-2230 (fixed in 2.235.4, a newer line); CVE-2024-23897 (fixed in 2.426.3, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).	1.642.2

If you run

Upgrade to

1.643 up to 1.650

1.650

All versions before 1.642.2

1.642.2

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

6 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2016-0803

Jenkins < 1.650 - Java DeserializationEDB-42394 · remote · java · 2017-07-30 · verified
Jenkins - XStream Groovy classpath Deserialization (Metasploit)EDB-43375 · remote · multiple · 2017-12-19 · verified

, 30 Oct 2026

83.3%Top 0.32%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.68%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9968 19.9/20

Threat reports0 reports 0.0/10

Public exploit code2 NVD references tagged Exploit; 2 Exploit-DB entries; 2 advisory exploit references; 2 PoC-in-GitHub repos; 1 Metasploit module 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total24.9

Record

Published: 7 Apr 2016
Modified: 5 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

exploit 2

vendor-advisory 2

x_refsource_MISC 1

x_refsource_CONFIRM 1

techniques