Jenkins CVE Checker
Enter your Jenkins version and see which exploited and critical Jenkins CVEs affect it, from CVE-2024-23897 to the 2026 core advisory. Weekly and LTS versions both work. It runs in your browser: you type a version number, nothing is scanned and nothing is sent anywhere.
Jenkins vulnerabilities this checker covers
The list is the Jenkins CVEs that were exploited in the wild or sit in the CISA Known Exploited Vulnerabilities catalog, plus the 2026-10-28 core advisory. It is the same table as our Jenkins vulnerabilities post, which has the sources. It is not every Jenkins security advisory, so a clean result means none of these apply, not that the version has no known bugs.
| CVE | Bug | KEV | Fixed in |
|---|---|---|---|
| CVE-2024-23897 | Jenkins CLI arbitrary file read | Yes | 2.442, LTS 2.426.3, LTS 2.440.1 |
| CVE-2017-1000353 | Remoting CLI deserialization RCE | Yes | 2.57, LTS 2.46.2 |
| CVE-2018-1000861 | Stapler URL routing | Yes | 2.154, LTS 2.138.4, LTS 2.150.1 |
| CVE-2015-5317 | Fingerprints page leak | Yes | 1.638, LTS 1.625.2 |
| CVE-2026-117612 to 117626 | 2026-10-28 core advisory (15 bugs) | No | 2.588, LTS 2.580.2 |
| CVE-2019-1003029 | Script Security sandbox bypass | Yes | Script Security 1.54 |
| CVE-2019-1003030 | Pipeline: Groovy sandbox bypass | Yes | Pipeline: Groovy 2.64 |
How weekly and LTS versions are compared
Jenkins has two release lines. Weekly releases have two parts, such as 2.442. LTS releases have three, such as 2.426.3: the first two parts are the weekly release the LTS line was branched from, and the last is the LTS update. A fix lands in a weekly release and is backported to some LTS lines, so a version is affected when it is older than the fix on its own line.
- CVE-2024-23897 is fixed in 2.442, LTS 2.426.3 and LTS 2.440.1.
2.441(weekly) and2.426.2(LTS) are affected.2.426.3and2.440.1are not: each has the backport on its own line.2.414.3is affected: the 2.414 line was branched before the fix and never got the backport.2.452.1is not: the 2.452 line was branched after 2.442, so it already contains the fix.
Frequently asked questions
How do I check if my Jenkins version is vulnerable?
Find the version at the bottom right of any Jenkins page or under Manage Jenkins, About Jenkins, enter it above and press Check version. The checker compares it with the fixed versions of each exploited Jenkins CVE on its own release line, weekly or LTS, and lists the ones that affect it.
Which Jenkins versions fix CVE-2024-23897?
Jenkins 2.442 (weekly), LTS 2.426.3 and LTS 2.440.1. So 2.426.2 is affected, while 2.426.3 and 2.440.1 are not. An LTS line branched before 2.442 that never got the backport, such as 2.414.x, is affected.
What Jenkins version should I upgrade to?
Jenkins 2.588 on the weekly line or LTS 2.580.2. Those include the fixes for the 2026-10-28 core advisory and every older CVE on this page. Keep the Script Security and Pipeline: Groovy plugins current as well.
Does this tool scan my Jenkins server?
No. It only takes a version number you type and compares it in your browser with a fixed list. It never connects to your server, and the version you enter is not sent anywhere.
Does a clean result mean my Jenkins is secure?
No. The checker covers the Jenkins CVEs known to be exploited or listed in CISA KEV, plus the 2026 core advisory, not every advisory or plugin. Patch to the latest release, remove anonymous read access and keep the controller off the public internet.