This vulnerability involves Jenkins deserializing arbitrary types defined in Jenkins core or plugins from attacker-controlled config.xml submissions. Exploitation allows attackers to handle HTTP requests as any user, potentially leveraging the Script Console to execute arbitrary code or read sensitive files on the Jenkins controller. The affected versions are Jenkins 2.567 and earlier, including LTS 2.555.2 and earlier. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and resulting in high confidentiality, integrity, and availability impacts. No official remediation level or patch information is provided in the input data. The Red Hat advisory URL is given but does not specify patch status in the provided content.

Successful exploitation can lead to full compromise of the Jenkins controller, including arbitrary code execution via the Script Console, impersonation of any user, unauthorized HTTP requests on behalf of users, and reading arbitrary files. This poses a critical risk to the confidentiality, integrity, and availability of the Jenkins environment and potentially connected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided Red Hat advisory link should be monitored for updates. Until an official fix is available, restrict access to Jenkins config.xml submissions to trusted users only and consider isolating Jenkins controllers to limit exposure.