CVE-2016-9299

The record

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

Affected packages

Related vulnerabilities

• GHSA-85h6-5m3v-gx37 Jenkins has a stored XSS vulnerability in node offline cause description Also affects org.jenkins-ci.main:jenkins-core
• GHSA-wfhp-qgm8-5p5c Jenkins has a build information disclosure vulnerability through Run Parameter Also affects org.jenkins-ci.main:jenkins-core
• CVE-2026-27099 Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both… Also affects org.jenkins-ci.main:jenkins-core
• CVE-2026-27100 Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that… Also affects org.jenkins-ci.main:jenkins-core
• GHSA-6837-qgrc-x5p6 Jenkins has a CSRF vulnerability on the login form Also affects org.jenkins-ci.main:jenkins-core
• GHSA-9p56-p6mw-w8qc Jenkins has a Denial of service vulnerability in HTTP-based CLI Also affects org.jenkins-ci.main:jenkins-core
• GHSA-fxj7-6v9w-xc76 Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core
• GHSA-hxjg-2jvf-h3rx Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core