3809501 - Apache Log4j deserialization (WVE-2026-007) and FOIS bypass risk – SAP Incentive Management

• Clarification and guidance requested regarding the reported Apache Log4j deserialization vulnerability (WVE-2026-007), which may allow bypass of FilteredObjectInputStream (FOIS) protections during Java deserialization and potentially lead to Remote Code Execution under specific deployment conditions.
• Confirmation requested on use of affected Apache Log4j versions (API 2.11.0–2.26.1; Core 2.8.0–2.26.1).
• Clarification requested on whether serialized Log4j LogEvent objects are accepted/deserialized or if FOIS-based serialized log receivers are used.
• Information requested on whether Java serialization filter (jdk.serialFilter) is enabled and properly configured.
• Request for internal assessment results, available mitigations/workarounds/configuration guidance, patch plans, and an official advisory or statement on potential exposure to WVE-2026-007.

• SAP Sales Performance Management
• Incentive Management

Apache Log4j, WVE-2026-007, deserialization, FOIS, FilteredObjectInputStream, LogEvent, jdk.serialFilter, RCE, remote code execution, serialized log receiver, gadget chain, vulnerability assessment, mitigation, exposure analysis, security advisory , KBA , CEC-SAL-COM-CORE , Core Data , Bug Filed