PT-2026-84291

🗓️ 01 Sep 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbu.gs👁 21 Views

Incomplete fix in jackson-databind allows arbitrary object instantiation via Comparable base type.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.1	1 Oct 202610:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to jackson-databind (CVE-2026-19032, CVE-2026-83557 and CVE-2026-68497)	29 Sep 202606:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable with Jackson Databind library	28 Sep 202606:07	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in Jackson package used by IBM Netezza Appliance	12 Oct 202607:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	28 Sep 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses jackson-databind-2.18.9.jar and httpclient5-5.3.1.jar and is vulnerable to CVE-2026-19032, CVE-2026-83557, CVE-2026-68497 and CVE-2026-64607	1 Oct 202610:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities (CVE-2026-19032, CVE-2026-83557)	28 Sep 202606:43	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability jackson-databind, golang.org/x/mod, image-size, bcprov-jdk18on, bcpkix-jdk18on, pyasn, setuptools, Mako, paramiko, http2-common Oct 2026v1	6 Oct 202615:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF003 for September 2026	7 Oct 202616:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs	8 Oct 202621:50	–	ibm

Source	Link
github	www.github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10
osv	www.osv.dev/vulnerability/CVE-2026-1605
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54513
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SU61748.json
osv	www.osv.dev/vulnerability/CVE-2026-27145
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-61728
osv	www.osv.dev/vulnerability/CVE-2026-42577
osv	www.osv.dev/vulnerability/ghsa-2m67-wjpj-xhg9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45536
bugzilla	www.bugzilla.suse.com/1282505

06 Oct 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.6 - 9.8

EPSS0.00717

SSVC

jackson-databind polymorphic deserialization object instantiation Comparable base type incomplete fix