diff --git a/CHANGELOG.md b/CHANGELOG.md
index 27bf691c623..b91901d36ae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+### Fixed
+
+- **CUMULUS-5570**
+  - Bumped ajv to v8.15.0 due to vulnerability CVE-2026-93690 (reported in Snyk)
+
 ## [v22.4.1] 2026-09-14
 
 ### Fixed
diff --git a/packages/common/package.json b/packages/common/package.json
index 6d09ae16bd0..fb689526cac 100644
--- a/packages/common/package.json
+++ b/packages/common/package.json
@@ -48,7 +48,7 @@
     "@cumulus/aws-client": "22.4.1",
     "@cumulus/errors": "22.4.1",
     "@cumulus/logger": "22.4.1",
-    "ajv": "^6.12.3",
+    "ajv": "^8.15.0",
     "follow-redirects": "^1.2.4",
     "fs-extra": "^5.0.0",
     "got": "^14.2.1",