Jenkins should be behind a perimeter regardless of active exploits, leaving it open to the public internet is just asking for trouble.