$ cve CVE-2018-14718 JSON

CVE-2018-14718

9.8

CRITICAL · CVSS 3.1 · EPSS 12.7% (pctl 96)

Patch early

EPSS 12.7% — above the 10% action threshold.

Description

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	12.68% — more likely to be exploited than 96% of all CVEs
Weakness	CWE-502
On CISA KEV	no
Public exploit	none known
Published	2019-01-02
Last modified	2026-06-17

Affected (26)

Vendor	Product
debian	debian linux
fasterxml	jackson-databind
netapp	oncommand workflow automation
netapp	snapcenter
netapp	steelstore cloud integrated storage
oracle	banking platform
oracle	business process management suite
oracle	communications billing and revenue management
oracle	communications instant messaging server
oracle	enterprise manager for virtualization
oracle	financial services analytical applications infrastructure
oracle	global lifecycle management opatch
oracle	jd edwards enterpriseone orchestrator
oracle	jd edwards enterpriseone tools
oracle	jdeveloper
oracle	nosql database
oracle	primavera p6 enterprise project portfolio management
oracle	primavera unifier
oracle	retail customer management and segmentation foundation
oracle	retail merchandising system
oracle	retail workforce management software
oracle	siebel engineering - installer \& deployment
oracle	siebel ui framework
oracle	webcenter portal
redhat	enterprise linux
redhat	openshift container platform

References

→ the Explorer · watch your stack · NVD