CVE-2019-14893

CVE-2019-14893 is a critical deserialization vulnerability in FasterXML jackson-databind, affecting all versions before 2.9.10 and 2.10.0, as well as products from NetApp and Oracle that incorporate it. This flaw allows an unauthenticated attacker to achieve arbitrary code execution by exploiting polymorphic deserialization with malicious objects, particularly when default typing or specific JsonTypeInfo modes are enabled. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk due to its network-based attack vector and high impact on confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.