Log4j Zero-Day Vulnerability

[Ajay.Batra]

Dear Customers and Partners,

A high severity vulnerability (CVE-2021-44228) impacting multiple versions of the Apache Log4j 2 utility was disclosed publicly on December 9, 2021. We want to reassure you that all business services at Software AG are online and up and running. Our teams are continuing to monitor the situation 24x7 so that your businesses are protected. Please visit the links below to understand which Software AG products are affected by this vulnerability and how to apply mitigation steps. Login with your Empower credentials to access the articles.

• Technical Security FAQ on Log4j Zero-Day Vulnerability - December 15th 2021

• Adabas

• Alfabet products are not impacted by the Log4j vulnerability

• ARIS Connect/Design-Server On-Premise

• ARIS Cloud Enterprise

• ARIS Process Performance Manager

• ConnX

• Cumulocity IoT On-Premise (including Edge, Apama, DataHub, Zementis)

• Cumulocity IoT Cloud (including Apama, DataHub, Zementis)

• MashZone

• MashZone NG

• Natural

• webMethods - Multiple Products

• webMethods ApplinX

• webMethods EntireX

• webMethods JIS/JI

Your security teams may also wish to examine the recommendations published by Apache in the “News” section of this page.

If you have any questions, please contact Software AG Global Support.

Sincerely,

Software AG