CVE-2015-8103

CVE-2015-8103 is a critical remote code execution vulnerability affecting Jenkins before version 1.638 and LTS before 1.625.2, as well as Red Hat Jenkins and OpenShift Container Platform. This flaw allows unauthenticated attackers to execute arbitrary code by sending a crafted serialized Java object to the Jenkins CLI subsystem, leveraging a deserialization vulnerability related to the commons-collections library and the "Groovy variant in 'ysoserial'". With a CVSS score of 9.8 (CRITICAL), it presents a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. Exploit code is publicly available, including Metasploit modules, indicating a high potential for exploitation, though there is no evidence of active exploitation in the wild or significant community discussion.