How severe is CVE-2018-1000861?

CVE-2018-1000861 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 98.3% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2018-1000861: Jenkins Stapler Web Framework Deserialization of

CISA Known Exploited Vulnerabilities

Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-02-10

Remediation due

2022-08-10

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2018-1000861

Description

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Severity

CVSS 3.1 · CISA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Exploitation Context

as of October 15, 2026

All KEV statistics→

CISA added CVE-2018-1000861 to the KEV catalog 1,158 days after its CVE record was published.
It is one of 6 Jenkins entries in the CISA KEV catalog, and one of 3 added in 2022.
Its current EPSS score (98.3%) is higher than that of 85% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
-	-	n/a

References

4 Links

Vendor advisories

RHBA-2019:0024

Vulnerability databases

106176

Other references

Record Details

Published

2018-12-10

Last updated

2025-10-21

Assigner (CNA)

mitre

Credited to

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.