Search/CVE-2020-9547
● CVE — Critical

CVE-2020-9547

Vendordebian, fasterxml, netapp, oracleProductdebian linux, jackson-databind, active iq unified manager, primavera unifier, weblogic server, jd edwards enterpriseone tools, banking platform, communications instant messaging server, retail xstore point of service, enterprise manager base platform, global lifecycle management opatch, jd edwards enterpriseone orchestrator, communications evolved communications application server, communications contacts server, communications network charging and control, autovue for agile product lifecycle managementDiscoveredMar 2, 2020UpdatedOct 7, 2026

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

View graph Watch Export
CVSS v3.1
9.8 CRITICAL
EPSS
18.4%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Aug 26, 2026
▲ 0.63pp
17.8% → 18.4% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
17 relationships
Timeline
disclosure → media coverage
Mar 2, 2020
Disclosure — published as a CVE record. · last revised by NVD Oct 7, 2026
Public PoC (1)
github.com/fairyming/CVE-2020-9547
Unverified third-party code — review before executing.