diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1a96ba2..04d51d0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 2.2.6
+
+### Maintenance
+
+- Update `jackson-databind`, `jackson-core`, and `jackson-annotations` dependencies to the 2.21 LTS line due to vulnerability
+
 ## 2.2.5
 
 ### Maintenance
diff --git a/pom.xml b/pom.xml
index ca2f5bc..526737e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
   <artifactId>lf-api-client-core</artifactId>
   <packaging>jar</packaging>
   <name>Laserfiche API Client Core</name>
-  <version>2.2.5</version>
+  <version>2.2.6</version>
   <url>https://github.com/Laserfiche/lf-api-client-core-java</url>
   <description>Java implementation of various foundational APIs for Laserfiche, including authorization APIs such as
     OAuth 2.0 flows for secure and easy access to Laserfiche APIs.
@@ -215,7 +215,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-annotations</artifactId>
-      <version>${jackson-version}</version>
+      <version>${jackson-annotations-version}</version>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
@@ -260,7 +260,9 @@
     <maven.compiler.source>${java.version}</maven.compiler.source>
     <maven.compiler.target>${java.version}</maven.compiler.target>
     <swagger-core-version>2.0.0</swagger-core-version>
-    <jackson-version>2.18.8</jackson-version>
+    <!-- [AI-Generated] by claude-sonnet-5 v0.001 on 2026-08-21: bumped Jackson to 2.21 LTS line, fixes CVE-2026-59889 -->
+    <jackson-version>2.21.6</jackson-version>
+    <jackson-annotations-version>2.21</jackson-annotations-version>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
   </properties>
 </project>