diff --git a/pom.xml b/pom.xml
index 9aa69f5b8..54c2c9b3c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -57,7 +57,13 @@
       <dependency.alfresco.xml-factory.version>1.3</dependency.alfresco.xml-factory.version>
       <dependency.alfresco-data-model.version>18.20</dependency.alfresco-data-model.version>
 
-      <dependency.jackson.version>2.17.2</dependency.jackson.version>
+      <!-- 2.18.6 fixes GHSA-72hv-8253-57qq (jackson-core async parser maxNumberLength bypass, MEDIUM).
+           NOTE: htrace-core 3.2.0-incubating shades Jackson 2.4.0 internally; this property cannot
+           override the shaded copy. The shaded JAR is physically removed in:
+             - search-services/packaging/pom.xml (unpack exclude + antrun delete)
+             - insight-engine/alfresco-insight-zeppelin/pom.xml (unpack exclude)
+           The alfresco-insight-jdbc shaded jar uses an explicit <includes> list so htrace is not shaded in. -->
+      <dependency.jackson.version>2.18.6</dependency.jackson.version>
 
       <dependency.google.guava.version>33.1.0-jre</dependency.google.guava.version>
       <dependency.apache-commons-compress.version>1.26.1</dependency.apache-commons-compress.version>
diff --git a/search-services/alfresco-search/pom.xml b/search-services/alfresco-search/pom.xml
index e15027878..254179f6c 100644
--- a/search-services/alfresco-search/pom.xml
+++ b/search-services/alfresco-search/pom.xml
@@ -74,6 +74,11 @@
                     <groupId>org.apache.hadoop</groupId>
                     <artifactId>*</artifactId>
                 </exclusion>
+                <exclusion>
+                    <!-- htrace deprecated; ships shaded Jackson 2.4.0; not used by Alfresco -->
+                    <groupId>org.apache.htrace</groupId>
+                    <artifactId>htrace-core</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>jdk.tools</groupId>
                     <artifactId>jdk.tools</artifactId>
@@ -134,6 +139,11 @@
                     <groupId>org.apache.hadoop</groupId>
                     <artifactId>*</artifactId>
                 </exclusion>
+                <exclusion>
+                    <!-- htrace deprecated; ships shaded Jackson 2.4.0; not used by Alfresco -->
+                    <groupId>org.apache.htrace</groupId>
+                    <artifactId>htrace-core</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>commons-configuration</groupId>
                     <artifactId>commons-configuration</artifactId>
@@ -198,6 +208,11 @@
                     <groupId>org.apache.hadoop</groupId>
                     <artifactId>*</artifactId>
                 </exclusion>
+                <exclusion>
+                    <!-- htrace deprecated; ships shaded Jackson 2.4.0; not used by Alfresco -->
+                    <groupId>org.apache.htrace</groupId>
+                    <artifactId>htrace-core</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>log4j</groupId>
                     <artifactId>log4j</artifactId>
@@ -258,6 +273,11 @@
                     <groupId>org.apache.hadoop</groupId>
                     <artifactId>*</artifactId>
                 </exclusion>
+                <exclusion>
+                    <!-- htrace deprecated; ships shaded Jackson 2.4.0; not used by Alfresco -->
+                    <groupId>org.apache.htrace</groupId>
+                    <artifactId>htrace-core</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>org.simpleframework</groupId>
                     <artifactId>simple-xml</artifactId>
@@ -426,6 +446,11 @@
                     <groupId>org.apache.hadoop</groupId>
                     <artifactId>*</artifactId>
                 </exclusion>
+                <exclusion>
+                    <!-- htrace deprecated; ships shaded Jackson 2.4.0; not used by Alfresco -->
+                    <groupId>org.apache.htrace</groupId>
+                    <artifactId>htrace-core</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>log4j</groupId>
                     <artifactId>log4j</artifactId>
diff --git a/search-services/packaging/pom.xml b/search-services/packaging/pom.xml
index aca210b66..fcbbd3cf9 100644
--- a/search-services/packaging/pom.xml
+++ b/search-services/packaging/pom.xml
@@ -111,7 +111,8 @@
                                     <outputDirectory>${project.build.directory}/solr-libs</outputDirectory>
                                     <excludes>**/jackson-dataformat-smile-*.jar,**/asm-3.3.1.jar,**/jackson-core-asl-*.jar,**/jackson-mapper-asl-*.jar,**/dom4j-1.6.1.jar,
                                         **/annotations-1.0.0.jar,**/spring-context-support-*.jar,**/spring-web-*.jar,**/woodstox-core-asl-4.4.1.jar, **/isoparser-1.1.18.jar,
-                                        **/metadata-extractor-2.9.1.jar,**/org.restlet.ext.servlet-2.3.0.jar,**/reload4j-*.jar
+                                        **/metadata-extractor-2.9.1.jar,**/org.restlet.ext.servlet-2.3.0.jar,**/reload4j-*.jar,
+                                        **/htrace-core-*-incubating.jar
                                     </excludes>
                                 </artifactItem>
                             </artifactItems>
@@ -180,6 +181,12 @@
                                 <delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/hadoop-common-2.10.1.jar" />
                                 <delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/hadoop-hdfs-2.10.1.jar" />
                                 <delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/hadoop-hdfs-client-2.10.1.jar" />
+                                <!-- Remove retired Apache HTrace incubator JAR. It ships shaded copies of jackson-core/databind 2.4.0 with
+                                     ~50 CVEs (CVSS up to 9.8) and cannot be patched via dependencyManagement. Its only consumers in this
+                                     distribution were the hadoop-*-2.10.1.jar files removed above, so it is safe to delete. -->
+                                <delete>
+                                    <fileset dir="${project.build.directory}/solr-${solr.version}" includes="**/htrace-core-*-incubating.jar" />
+                                </delete>
                                 <delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/avatica-core-1.9.0.jar" />
                                 <delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/org.restlet-2.3.0.jar" />
                                 <delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/org.restlet.ext.servlet-2.3.0.jar" />
diff --git a/search-services/packaging/src/main/resources/licenses/notice.txt b/search-services/packaging/src/main/resources/licenses/notice.txt
index 063290267..41e06e6ef 100644
--- a/search-services/packaging/src/main/resources/licenses/notice.txt
+++ b/search-services/packaging/src/main/resources/licenses/notice.txt
@@ -60,9 +60,9 @@ chemistry-opencmis-server-bindings-1.0.0.jar    http://chemistry.apache.org/
 failureaccess-1.0.2.jar https://mvnrepository.com/artifact/com.google.guava/failureaccess/1.0.2
 listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar https://mvnrepository.com/artifact/com.google.guava/listenablefuture
 quartz-2.3.2.jar http://quartz-scheduler.org/
-jackson-core-2.17.2.jar https://github.com/FasterXML/jackson
-jackson-annotations-2.17.2.jar https://github.com/FasterXML/jackson
-jackson-databind-2.17.2.jar https://github.com/FasterXML/jackson
+jackson-core-2.18.6.jar https://github.com/FasterXML/jackson
+jackson-annotations-2.18.6.jar https://github.com/FasterXML/jackson
+jackson-databind-2.18.6.jar https://github.com/FasterXML/jackson
 commons-httpclient-3.1-HTTPCLIENT-1265.jar http://jakarta.apache.org/commons/
 spring-beans-7.0.7.jar http://projects.spring.io/spring-framework/
 spring-context-7.0.7.jar http://projects.spring.io/spring-framework/
@@ -167,7 +167,6 @@ eigenbase-properties-1.1.5.jar
 gmetric4j-1.0.7.jar
 guava-33.1.0-jre.jar
 hppc-0.7.1.jar
-htrace-core-3.2.0-incubating.jar
 httpclient-4.5.14.jar
 httpcore-4.4.1.jar
 httpmime-4.4.1.jar