CVE-2016-9299

CRITICAL EXPLOITED NUCLEI

Jenkins < 2.32 and LTS < 2.19.3 - Remote Code Execution via LDAP Query Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2016-9299 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including Metasploit, r00t4dm, Matthias Kaiser, Alisa Esage, Ivan, YSOSerial, including a Metasploit module exploits/linux/misc/jenkins_ldap_deserialize. A Nuclei detection template is also available.

AI-analyzed exploit summary This Metasploit module exploits CVE-2016-9299, a Java deserialization vulnerability in Jenkins, allowing unauthenticated remote code execution via crafted HTTP requests. It uses YSOSerial payloads for exploitation.

Description

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/44642

This Metasploit module exploits CVE-2016-9299, a Java deserialization vulnerability in Jenkins, allowing unauthenticated remote code execution via crafted HTTP requests. It uses YSOSerial payloads for exploitation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Jenkins 2.31
No auth needed
Prerequisites: Network access to Jenkins CLI port (default 8080) · Jenkins version vulnerable to CVE-2016-9299
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SUSPICIOUS
by r00t4dm · poc
https://github.com/r00t4dm/Jenkins-CVE-2016-9299

The repository contains no actual exploit code for CVE-2016-9299, only JavaScript bundles and scripts unrelated to the vulnerability. The README is empty, and there is no technical analysis or PoC provided.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: Jenkins
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Matthias Kaiser, Alisa Esage, Ivan, YSOSerial · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb

This Metasploit module exploits a Java deserialization vulnerability in Jenkins (CVE-2016-9299) to achieve remote code execution. It uses a crafted LDAP server to deliver a malicious serialized payload, bypassing authentication.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Jenkins 2.31
No auth needed
Prerequisites: Network access to Jenkins CLI port (8080) · LDAP server setup for payload delivery
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Jenkins CLI - HTTP Java Deserialization
CRITICALVERIFIEDby iamnoooob,rootxharsh,pdresearch
Shodan: product:"jenkins"
FOFA: icon_hash=81586312

References (10)

Core 10
Core References
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44642/
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/11/12/4
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94281
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/11/14/9

Scores

CVSS v3 9.8
EPSS 0.8925
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2016-11-16
CWE
CWE-90
Status published
Products (4)
fedoraproject/fedora 25
jenkins/jenkins < 2.19.2
jenkins/jenkins < 2.31
org.jenkins-ci.main/jenkins-core 2.20 - 2.32Maven
Published Jan 12, 2017
Tracked Since Feb 18, 2026