CVE-2024-23897 — exploited in the wild

CVE-2024-23897: Vulnerability in Jenkins Project Jenkins

Exploitation observed by OffSeq honeypot sensors · last 30 days · last seen 12 hours ago · first observed 2026-09-28 (25 days ago)

Listed in CISA's Known Exploited Vulnerabilities catalog and still under active attack against OffSeq honeypot decoys.

About CVE-2024-23897

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Vendor: Jenkins ProjectCWE-27

OffSeq's global honeypot fleet recorded 76 exploitation attempts against CVE-2024-23897 from 9 distinct source IPs in the last 30 days — direct in-the-wild telemetry: every hit is a real attacker probing a decoy, not a scan of a vulnerability database.

References