SAP Knowledge Base Article - Preview

3808704 - Critical Vulnerability CVE-2026-49844 reported in SAP PI/PO Adapter for Apache Log4j

Symptom

  • Vulnerability scan reports findings for CVE-2026-49844 related to Log4j libraries on SAP NetWeaver.
  • The scanner flags installed versions as vulnerable and recommends log4j library version fix to 2.25.5.
    Path
    /usr/sap/<SID>/<Instance number JXX>/j2ee/cluster/bin/ext/com.sap.aii.adapter.ws.cxf.lib/lib/org.apache.logging.log4j-log4j-core-<Installed version>.jar
      Installed version : (e.g. 2.25.3, 2.24.3)
      Fixed version     : 2.25.5 


Read more...

Environment

  • SAP NetWeaver 7.5

Product

SAP NetWeaver all versions

Keywords

CVE-2026-49844, Log4j, AS Java, PI, PO, Process Orchestration, MapMessage, JSON serialization, false positive, vulnerability scan, log4j-core, com.sap.aii.adapter.ws.cxf.lib, Java Web Service Adapter, security notes, patch day , KBA , BC-XI-CON-JWS , Java Web Service Adapter , Known Error

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.