CVE-2016-0792

CVE-2016-0792 is a critical deserialization vulnerability affecting multiple unspecified API endpoints in Jenkins versions prior to 1.650 and LTS versions prior to 1.642.2. This flaw, related to XStream and groovy.util.Expando, allows remote authenticated users to execute arbitrary code by submitting malicious serialized data within an XML file. With a CVSS score of 8.8 (HIGH), it presents a low-complexity attack vector that can lead to complete compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog or Hot List, public exploit modules exist, including a Metasploit module and entries on ExploitDB, indicating readily available exploit code. Despite the high EPSS score and FAUCET Risk Score of 100/100, there is no recorded community discussion or media coverage for this vulnerability.