jumpserver vulnerabilities and fixes

Recent CVEs affecting jumpserver, with upgrade or downgrade steps. 24 tracked.

jumpserver has 24 tracked vulnerabilities, 7 critical. A fixed release or vendor patch exists for 23. Most recent: 2026-03-13. Highest priority: CVE-2023-48193 (score 64/100).

• CVE-2025-62712 CRITICAL 9.6 UPGRADE JumpServer is an open source bastion host and an operation and maintenance security audit system
• CVE-2025-62795 HIGH 7.1 UPGRADE JumpServer is an open source bastion host and an operation and maintenance security audit system
• CVE-2023-48193 CRITICAL 9.8 DOWNGRADE Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary c
• CVE-2026-31864 MEDIUM 6.8 UPGRADE JumpServer is an open source bastion host and an operation and maintenance security audit system
• CVE-2026-31798 MEDIUM 5.0 UPGRADE JumpServer is an open source bastion host and an operation and maintenance security audit system
• CVE-2025-27095 MEDIUM 4.3 UPGRADE JumpServer is an open source bastion host and an operation and maintenance security audit system
• CVE-2024-40629 CRITICAL 10.0 UPGRADE JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on
• CVE-2024-40628 CRITICAL 10.0 UPGRADE JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on
• CVE-2024-29202 CRITICAL 9.9 UPGRADE JumpServer is an open source bastion host and an operation and maintenance security audit system
• CVE-2024-29201 CRITICAL 9.9 UPGRADE JumpServer is an open source bastion host and an operation and maintenance security audit system
• CVE-2024-29024 MEDIUM 4.6 UPGRADE JumpServer is an open source bastion host and an operation and maintenance security audit system. An authentic
• CVE-2024-29020 MEDIUM 4.6 UPGRADE JumpServer is an open source bastion host and an operation and maintenance security audit system
• CVE-2024-24763 MEDIUM 4.3 UPGRADE JumpServer is an open source bastion host and an operation and maintenance security audit system
• CVE-2023-46138 LOW 3.7 UPGRADE JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specific
• CVE-2023-46123 MEDIUM 5.3 UPGRADE jumpserver is an open source bastion machine, professional operation and maintenance security audit system tha
• CVE-2023-43652 HIGH 8.2 UPGRADE JumpServer is an open source bastion host
• CVE-2023-43651 HIGH 8.5 UPGRADE JumpServer is an open source bastion host
• CVE-2023-43650 HIGH 8.2 UPGRADE JumpServer is an open source bastion host
• CVE-2023-42820 HIGH 7.0 UPGRADE JumpServer is an open source bastion host
• CVE-2023-42819 HIGH 8.9 UPGRADE JumpServer is an open source bastion host
• CVE-2023-42818 MEDIUM 5.4 UPGRADE JumpServer is an open source bastion host
• CVE-2023-42442 HIGH 8.2 UPGRADE JumpServer is an open source bastion host and a professional operation and maintenance security audit system
• CVE-2023-28110 MEDIUM 5.7 UPGRADE MITIGATE Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of
• CVE-2021-3169 CRITICAL 9.8 UPGRADE An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token

FAQ

How do I fix jumpserver vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is jumpserver being exploited right now?

None of the tracked jumpserver CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which jumpserver CVE should I patch first?

CVE-2023-48193 currently ranks highest (64/100): Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary c.

RSS feed for jumpserver · ← Back to latest CVEs