The vulnerability of the `NioPathHelper.deserialize` method in the Jackson-Databind library allows a hacker to load arbitrary files.

🗓️ 23 Sep 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 23 Views

Jackson-Databind NioPathHelper.deserialize allows arbitrary file loading via unsafe class loading.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.1	1 Oct 202610:04	–	ibm
IBM Security Bulletins	Security Bulletin: : IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Sep 202606:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Apache Log4j, FasterXML jackson-databind, FasterXML jackson-core, and Bouncy Castle libraries	14 Oct 202607:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to jackson-databind (CVE-2026-19032, CVE-2026-83557 and CVE-2026-68497)	29 Sep 202606:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable with Jackson Databind library	28 Sep 202606:07	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in Jackson package used by IBM Netezza Appliance	12 Oct 202607:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	28 Sep 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM FileNet Content Manager(FNCM) 5.6.0-IF009 and 5.7.0-IF006 for September 2026	6 Oct 202618:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses jackson-databind-2.18.9.jar and httpclient5-5.3.1.jar and is vulnerable to CVE-2026-19032, CVE-2026-83557, CVE-2026-68497 and CVE-2026-64607	1 Oct 202610:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities (CVE-2026-19032, CVE-2026-83557)	28 Sep 202606:43	–	ibm

Vulners

Node

OR

fasterxml,_llc jackson-databindRange2.8.0–2.18.10

fasterxml,_llc jackson-databindRange2.19.0–2.21.6

fasterxml,_llc jackson-databindRange2.22.0–2.22.2

fasterxml,_llc jackson-databindRange3.0.0–3.1.6

fasterxml,_llc jackson-databindRange3.2.0–3.2.2

Source	Link
github	www.github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551
github	www.github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166
github	www.github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d
github	www.github.com/FasterXML/jackson-databind/pull/6129
github	www.github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf
web	www.web.nvd.nist.gov/view/vuln/detail

25 Sep 2026 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 25

CVSS 35.3

EPSS0.00529

Jackson-Databind NioPathHelper.deserialize unsafe dynamic class loading load arbitrary files