cyfenced.com →

[ CVE-2026-59889 · Published 14 Jul 2026 ]

Vulnerability in FasterXML jackson-databind

CVSS 6.5 EPSS <1%11 agency advisoriesNo fix listed yet

[ Description ]Official description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • NCSC-NLNCSC-2026-0448

    Vulnerabilities fixed in Oracle Fusion Middleware Translated from Dutch

    Probability/damage H/HCVE-2026-54513CVE-2026-56741CVE-2026-59649+191 more CVEs
  • CERT-FRCERTFR-2026-AVI-1349

    Multiple vulnerabilities in Oracle Database Server Translated from French

    Multiple vulnerabilities have been discovered in Oracle Database Server. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

    CVE-2026-91499CVE-2026-93565CVE-2026-93494+41 more CVEs
  • BSI CERT-BundWID-SEC-2026-4090

    Oracle Communications: Multiple vulnerabilities Translated from German

    Risk highCVE-2026-101763CVE-2026-58389CVE-2026-56740+85 more CVEs
  • BSI CERT-BundWID-SEC-2026-4084

    Oracle Siebel CRM: Multiple vulnerabilities Translated from German

    Risk highCVE-2026-11332CVE-2026-91427CVE-2026-101444+118 more CVEs
  • BSI CERT-BundWID-SEC-2026-4078

    Oracle Fusion Middleware: Multiple vulnerabilities Translated from German

    CVE-2026-91212CVE-2023-43622CVE-2026-42779+191 more CVEs
  • BSI CERT-BundWID-SEC-2026-4061

    Oracle Database Server: Multiple vulnerabilities Translated from German

    CVE-2026-91615CVE-2026-59889CVE-2026-101510+10 more CVEs
  • CERT-FRCERTFR-2026-AVI-1336

    Multiple vulnerabilities in IBM products Translated from French

    Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-14671CVE-2026-11548CVE-2022-22950+490 more CVEs
  • CERT-FRCERTFR-2026-AVI-1291

    Multiple vulnerabilities in IBM products Translated from French

    Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-49978CVE-2025-27895CVE-2026-59651+195 more CVEs
  • CERT-FRCERTFR-2026-AVI-1249

    Multiple vulnerabilities in VMware products Translated from French

    Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

    CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs
  • CERT-FRCERTFR-2026-AVI-1256

    Multiple vulnerabilities in IBM products Translated from French

    Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-27980CVE-2026-58055CVE-2026-49978+360 more CVEs
  • BSI CERT-BundWID-SEC-2026-3665

    SOS GmbH JobScheduler: Multiple vulnerabilities allow an unspecified attack Translated from German

    CVE-2026-19032CVE-2026-59889CVE-2026-9563+7 more CVEs

[ References ]References