Released on November 11, 2026.

Click here for a list of known issues (release notes).

Click here for a list of security vulnerabilities addressed.

The following table lists issues fixed in this release:

Tip: To search for specific issues, enter keywords in the relevant filter.
Component Issue Number Description
ADE OCTA-92375

AppBuilder trims procedure code

ADE OCTA-83460

Incremental Dump writes Add Index statement for a new active index into the Offline_Section for phased load.

ADE OCTA-80798

When importing schema from SQL Server DataServer, when a varchar(max) array field is encountered, it throws the below error 10885 that causes crashes when attempting to compile code referencing the field in question.

ADE OCTA-85705

Cannot load (import) Audit policy event definitions programmatically

ADE / DataServers OCTA-92614

When using the Delta df to MS SQL Server Conversion tool in OpenEdge 12.8.11 with the Include Defaults option enabled, the generated SQL script omits DEFAULT constraints for INT64 fields.

AdminServer OCTA-84295

Admin Server crashes randomly with “The error was triggered by the auth.dll module, which caused the JVM to terminate unexpectedly with the following exception: EXCEPTION_ACCESS_VIOLATION (0xc0000005).”

DataServers OCTA-85939

The ABL session crashes with error (4208) during REPOSITION-BACKWARDS(n) when using Oracle DataServer in C/S mode.

DataServers OCTA-100449

Oracle DataServer may return incorrect post-update CLOB content when applications access CLOB fields from the OLD BUFFER inside an ABL WRITE trigger.

DataServers OCTA-98220

An ABL WRITE trigger does not fire when a CLOB field is modified using the COPY-LOB statement with MSS DataServer.

DataServers OCTA-92901

MS SQL dataserver does not refresh the buffer within the same session when using the RECID function and the OE database is migrated with the “Try primary for RowId” option.

DataServers OCTA-99018

MSS DataServer may return incorrect post-update CLOB content when applications access CLOB fields from the OLD BUFFER inside an ABL WRITE trigger.

DataServers OCTA-80354

Using QUERY-TUNING (NO-JOIN-BY-SQLDB) crashes OpenEdge 12.8.8 prowin client when using OpenEdge DataServer for MSS SQL Server

DB OCTA-96277

Outdated 11.7 executable bundled in the 12.8 install's 117_dbutil directory

DB OCTA-86569

Online backup on the repl target crashed with “No return pbktbl in bmRemoveQAreaDbkey”

DB OCTA-2823

When aiarchiver setdir is run with -aiarcdircreate option, it creates the directory specified by  but returns error.

rfutil  -C aiarchiver setdir  -aiarcdircreate

An error occurred while trying to create one of the directories in . (13645)

This is now fixed so that it returns a success message:

The after-image management daemon has been notified about the new archive directory. (13208)

DB OCTA-95865

Threaded binary dump does not respond to control-c, it has been fixed so that a threaded binary dump will now respond to control-c.

DB OCTA-83134

When OpenEdge Replication is configured to use a service name (defined in /etc/services) in the replication properties file, the command:

dsrutil  -C validate

fails with the following error:

Unable to contact database '' on : for agent ''. (19461)

DB OCTA-88654

Changing TXE commit lock skip limit in ‘Adjust TXE Options’ menu of PROMON does not reflect in _Dbparams VST.

Install OCTA-70588

Deselecting the recommended component 'OpenEdge Explorer' during a custom OpenEdge 12.2.16 installation still installs and starts OpenEdge Explorer.

Install OCTA-84389

The OpenEdge 12.8.8 Client Networking 32-bit .msi installer installs the prox.dll in the wrong place.  After the installation the prox.dll is located in: “C:\Program Files (x86)\Common Files\Progress Software\11” But not the expected: “C:\Program Files (x86)\Common Files\Progress Software\12”

Install OCTA-91938

Visual C++ x64 Redistributable not updated by openedge update install.

Install OCTA-92245

OpenEdge installer is asking to install RDBMS license despite OE RDBMS Adv Enterprise license being present

Install OCTA-85360

Client-Networking 32-bit MSI install fails to access mscomctl.ocx

Install OCTA-89028

WARNING: ESAM Installation failed

--------------------------------------

The ESAM installation has failed. For more details, contact the administrator to review either the ESAM_Install_mm_dd_yyyy_hh_mm_ss.log or the OpenEdge_External_Security_Administration_Manager_Install_mm_dd_yyyy_hh_mm_ss.log. Both files are accessible at the following location: C:\Windows\System32\openedge.d\audit

However, when you click “OK”, the installation continues after the warning.

Install OCTA-34415

When a silent install is attempted, and the OE installer is for a machine type incompatible with the machine type of the machine on which the response.ini was generated, the messages returned do not indicate that the discrepancy exists.

Install OCTA-72116

When only PASOE license is installed, during installation installer asks for the internationalization settings, but then in the DLC/startup.pf the settings are not set.

Install OCTA-94731

OpenEdge Update Installer Does Not Update %DLC%\pdbfiles to Match Updated Binaries

Lang OCTA-89159

Session may crash during PAUSE statement when running an ABL application with .NET windows if the procedure-complete event of an async request got processed prior to the PAUSE statement.

Lang OCTA-82859

Client session may crash if you disconnect and reconnect to a PASOE or WebServices server while asynchronous requests are still pending and an asynchronous request has no event procedure defined.

Lang OCTA-83467

READ-JSON fails to update the nested foreign key field of a ProDataSet child table if the child table values appear before the parent key value in the JSON input string, and there are no parent-fields-before or parent-fields-after for the data-relation between the parent and child.

Lang OCTA-89527

If a VAR statement is encountered in the procedure’s Main block after a sub-compile block (PROCEDURE, FUNCTION, ON trigger, etc.) or DEFINE FRAME statement, the AVM issues error 20006: ‘The VAR statement must precede any executable statement within block contexts where it is allowed’ .

Lang OCTA-87254

Quotes around command arguments used with OS-COMMAND statement are stripped when executed by PASOE Web Transport

Lang OCTA-83571

Progress.Util.ResourceManager is unable to locate .resx files if they are located in a directory containing ASCII extended characters in the name of the directory.

Lang OCTA-81156

Progress.Lang.Stop exceptions are not raised when using class property SET accessors combined with a single ASSIGN statement.

Lang OCTA-93636

PROCESS EVENTS can hang if making asynchronous PASOE requests with -maxConnections parameter, and the number of outstanding asynchronous requests exceeds the -maxConnections value.

Lang OCTA-88150

Error 683 when running a session compile of a program with a shared frame using -defuntrans startup parameter.

Lang OCTA-96239

Interactive _progres can continue executing ABL code despite a fatal error message if pending frames needs to be flushed out to the current output device.

Lang OCTA-97381

Incorrect behavior when using SESSION:NUMERIC-SEPARATOR on a Windows client started with -useOsLocale and a Windows locale configured to use a non-ASCII character (e.g. NBSP, a non-breaking space) as the digit grouping symbol.

Lang OCTA-83610

Nested constructor calls with string literals will not appear in STRING-XREF output.

Lang OCTA-91341

Invalid -0 result from ABL AGGREGATE statement when no records satisfy the query.

Lang OCTA-69079

Quotes around command arguments used with OS-COMMAND statement are stripped when executed by a PASOE agent

Lang OCTA-94245

Chained use of Safe Navigation Operator (?:) throws error 10068 when used on .NET objects.

Lang OCTA-81808

Breakpoints in a procedure or class file aren’t honored if the file is recompiled during a debugging session. This issue also prevents the debugger from setting breakpoints in OEUnit tests.

Lang OCTA-85461

The AVM may crash when a widget which has a pending event trigger is deleted before the trigger is executed.

Lang OCTA-91662

When using PROLIB -[LibraryName] -pf [FileListName.lst] to build a library, file names are truncated at 132 bytes.

Lang OCTA-84952

When using .NET OpenClient, if a PASOE request uses DO ON STOP in multiple locations, then a STOP condition shows in the log as being raised in the DO ON STOP block and not in the actual location where the stop was raised if in a nested call.

Lang OCTA-97500

A client session can crash if a FRAME with SIDE-LABELS has fields with long labels.

Lang OCTA-94146

A crash occurs when compiling a program that performs a BUFFER-COPY from one TEMP-TABLE defined LIKE a database table to another TEMP-TABLE defined LIKE the same database table.

This produces the following C stack in the generated protrace file (attached):

smBCmpWhen

smbufcpy

smstmt

smsem

cr_compile

crpsrch

crrun_entry

rninterpret

crrun_rcsv

rncmpile

Lang OCTA-94411

A memory leak may occur if you set a property with an implementation via a chained expression where the property resides in the object instance that was returned via one of the expressions in the chain expression.

Lang OCTA-83226

Values that begin with a dash were incorrectly rejected when used in a connect string, such as -SOAPEndpointPassword ‘-secret’;, resulting in error “You have not supplied a parameter for argument... (1403)”

Lang OCTA-99140

Using the QUOTER() function with a low -s value (e.g. 50) can return error : Not enough space to add quotes to item. (10083)

Lang OCTA-85245

A memory violation error can happen during the loading of the .df when trying to manage Progress.Lang.LockConflict.

Lang OCTA-94031

Abbreviated widget properties generate a compile error with the require-full-keywords compiler option instead of warning

Lang OCTA-86097

Assigning a LONGCHAR variable value to a buffer-field column-label can display garbled text.

Lang OCTA-92004

Using ADD-INTERVAL to add 0 years to a date changes year when year is negative

Lang OCTA-93590

Using a custom format (e.g. “29999”) in an editable browse cell can return wrong SCREEN-VALUE and INPUT-VALUE.

Lang OCTA-81449

Accessing the root object directly for a ProDataGraph java open client may throw a NullPointerException.

Lang OCTA-84444

Indeterminate arrays with constant initial values are initialized at runtime, when the array definition is encountered.  ABL that accesses a variable before the DEFINE VARIABLE statement will see the variable with an unknown EXTENT, ? .  For example, RUN proc  before DEFINE VARIABLE, where  proc appears after the definition and accesses the indeterminate array.

Lang OCTA-87239

AGGREGATE statement with COUNT operation can sometimes read records even if there is no record selection needed.

Lang OCTA-89572

The PASOE SOAP transport may crash during XML serialization when a SOAP operation returns a dataset response.

Lang OCTA-94898

The displayed value of a disabled fill-in isn’t updated when the screen-value is changed to an empty string.

Lang OCTA-80239

Application crashes occur when INNER-LINES reference outdated coordinates. This issue may be noticed during a combo-box dropdown action.

Lang OCTA-88919

The Procedure Editor may display non-ASCII characters incorrectly when -cpinternal is set to a code page other than UTF-8.

Lang OCTA-96783

The GUI client may crash when multi-byte characters are pasted in a fill-in whose format includes fill characters, such as “xxxx-xxxx-xxxx”.

Lang OCTA-80097

The bprowsdldoc and CONNECT methods are not accepted when the UsingPolicy element (a component of the WS-Policy WSDL extension) is included within the WSDL.

Lang OCTA-89567

The Windows client can crash when creating or assigning popup-menus.

Lang OCTA-89439

The READ-JSON method on a TEMP-TABLE triggers a client crash reading an empty JSON array while inferring schema from the JSON string.

Lang OCTA-82803

The AVM may crash when the loading of a large number of records is interrupted by pressing Ctrl-C.

Lang OCTA-94088

The RANDOM() function generates a repeated sequence of values in a Kubernetes/Docker container, even when -rand 2 is used

Lang / OEM / PASOE OCTA-52381

OEM/OEE Agent Metrics show date/time values with an incorrect UTC offset.

Lang / PASOE OCTA-91656

A crash (Fatal Signal 11) could occur during ABL session shutdown when a trigger or procedure using a BUFFER parameter was cleaned up after the procedure that owned that buffer had been destroyed.

Lang / PASOE OCTA-72376

PASOE agent crashes when SOAP request to a 3rd party provider fails due to SSL errors

Lang / PASOE OCTA-94851

Using the ‘-connectionLifetime’ parameter to consume web services results in error 11773.

Lang / PDSOE OCTA-94304

Progress Developer Studio for OpenEdge (PDSOE) crashes during startup and generates hs_err_pid logs when the required .NET runtime is not installed.

Lang / STAT OCTA-96288

ABL batch clients occasionally crash after running proGetStack (SIGUSR1) on the PID of the ABL batch client.

OEM OCTA-75416

Fathom tomcat process consuming high CPU.

OEM OCTA-94582

OEE not indicating actual database status.

OEM OCTA-90137

OpenEdge management is giving CPU and memory usage alerts for usage above 100%

OEMP OCTA-98669

In OpenEdge Memory Profiler (OEMP), deleting a large recording could cause excessive database Before-Image (BI) file growth and disk space exhaustion because child records were deleted in large, unbatched transactions. The deletion process has been updated to batch record deletions into smaller transaction scopes, preventing unexpected BI growth.

OpenSSL/TLS / PASOE OCTA-79675

Client connection to PASOE fails after 60 seconds with TLS 1.3 Protocol.

OpenSSL/TLS / SQL OCTA-92604

If a SQL client dies or becomes unresponsive during connection while performing SSL negotiation with OpenEdge database, it might result in OpenEdge SQL Server process, (_sqlsrv2) to hang.

PASOE OCTA-97254

STOPPED local sessions never evicted when the connection are terminated via idleSessionTimeout leading to OOM

PASOE OCTA-79684

In PASOE, setting statusEnabled within a webapp-specific section of openedge.properties is ignored, causing only the global [AppServer] setting to take effect.

PASOE OCTA-66911

Health Scanner default returns a failed state out of the box

PASOE OCTA-67768

Error “The network path was not found” occurs when creating a pasoe instance or deploying webapps to an existing pasoe instance at the root of the drive. For example, using pasman/tcman.bat to create or deploy to C:/oepas1 fails with this error.

PASOE OCTA-91640

A delay could occur during specific TLSv1.3 SSL retry scenarios in ABL client communication. This fix removes the pause and relies on the existing retry logic to handle the condition correctly, eliminating the delay while maintaining reliable network communication.

PASOE OCTA-24894

Error reported in PASOE for an erroneous HTTP request doesn’t provide clear information

PASOE OCTA-92577

Error 'sem_timedwait() error: -1 errno: 4' shuts down the admin thread, terminating the agent

PASOE OCTA-85223

Cannot clear PASOE instance log files: check for locked files." when starting a pasoe instance using pasoestart or the OEM webinterface

PASOE OCTA-84148

Client-Principal attributes that contain special characters are not displayed properly.

PASOE OCTA-28570

Attempting to pass a dataset back from a PAS OE instance to a user authenticated by MS AD, belonging to many membership groups causes an ACCESS VIOLATION crash.

PASOE OCTA-87706

If the location of the Tomcat catalina PID file is changed, then the TCMAN PASOESTART or PASMAN PASOESTART command will fail.

PASOE OCTA-71615

Failed Oauth2 authentication not shown in authn/authz logfile

PASOE OCTA-70037

PASOE instance fails to start when using adding in the Spring Anonymous filter in Spring configuration files.

PASOE OCTA-28494

No service found error when changing the relative URI of a REST service

PASOE OCTA-91907

When invoking oemanager.sh to check instance status, there is a new line item in the output with "OESECURITY: UNKNOWN"

PASOE OCTA-28439

When creating a new instance, the instances.unix / instances.windows files are copied from {CATALINA_HOME}/conf > {CATALINA_BASE}/conf. While the  $CATALINA_BASE/conf instances files  are not used, the content is not consistent across instance directories and create confusion

PASOE OCTA-49577

When certain illegal/malformed requests were sent to a Progress Application Server for OpenEdge (PASOE) production instance, the returned Tomcat error page included the underlying Tomcat server version. This has been corrected so production PASOE instances no longer include the Tomcat version in these error pages by default.

PASOE OCTA-79649

Using the OE Manager REST API oemanager/applications//sessions?sessionID=&terminateOpt=2, the agent is terminating session immediately instead of waiting for the current request to complete.

PASOE OCTA-76311

Using binaryUploadMaxSize in openedge.properties is a no-op.  This property (when fetched using get-config() function) always returns ?.

PASOE OCTA-44619

Unable to deploy a WAR file due to an error coming from the web application deployment tailoring

PASOE OCTA-28501

There's a risk of name collision when running the tcman clean -A on Windows because the archive folder name format as defined in the %DLC%/oepas1/bin/tcmanager.ps1 doesn't guarantee uniqueness.tcmanager.ps1 reads:  $_subdir="$(get-date -f MM-dd-yyyy-ss)"

PASOE OCTA-46760

The “Get OEABL WebApp Metrics” operation of the PASOE REST API always returns HTTP 500 error.

PASOE OCTA-45665

The tcman / pasman plist command can output invalid child processes.

PASOE OCTA-87189

The PASOE Session Manager process (java) will crash when it receives signal 15 (SIGTERM).

PASOE OCTA-86408

The PASOE Agent runs out of ABL Sessions before reaching maxAblSessionsPerAgent.

PASOE OCTA-99435

The OpenEdge tailoring scripts may fail if there are Apache Ant libraries located in %USERPROFILE%\.ant\lib .

PASOE OCTA-73155

The ${psc.as.https.connectiontimeout} variable is missing from the HTTPS acceptor section within the server.xml file.

PASOE OCTA-91761

Terminating hung PASOE agent crashed database

PASOE OCTA-42102

Running “tcman.bat clean -A” online causes error about agent log being in use.

PASOE OCTA-79716

SOAP requests are not updating the pasoe Application Metrics 'Max Concurrent Clients:' counter and the related 'PAS Application Concurrent Connected Clients' chart when using OpenEdge 12.2.17 or 12.8.8Under OpenEdge 11.7.22 the pasoe Application Metrics 'Max Concurrent Clients:' counter is being updated when doing SOAP requests

PASOE OCTA-78096

PASOE API doesn't need a valid Application Name to stop Agent or ABL Session

PASOE OCTA-52964

OEMANAGER REST API calls will hang forever if an Agent is in a hung state.

PASOE OCTA-83333

PASOE 12.8.6 instance running on linux becomes randomly unresponsive and NoAvailableConnection exception messages are shown in [ablapp].[date].log

PASOE OCTA-87772

PASOE ABL Sessions crash with fatal signal 11 when making calls to another PASOE instance via SSL.

PASOE OCTA-84344

PASOE ABL Sessions randomly crash when calling a HTTPS REST service with the ABL HTTP client.

PASOE OCTA-58484

PASOE agent fails to start if agent startup parameter has the -pf parameter and the .pf file contains a -param that contains value starting with dash (-).

PASOE OCTA-92940

PASOE agent may crash when handling a .NET exception with a NO-ERROR.

PASOE OCTA-34818

Removal of the psc.as.msg.timeout property in catalina.properties and its relevant Message Timeout field in OEM.

PASOE OCTA-52242

PASOE instance fails silently after enabling JMX ports through the -Dcom.sun.management.jmxremote.port and -Dcom.sun.management.jmxremote.rmi.port JVM parameters

PASOE OCTA-86434

When waiting for a record lock in a PASOE Application using a shared memory connection to the database, the STOP-AFTER time-out and Administrative STOP operations are ignored until the lock wait is satisfied.

PASOE OCTA-96765

PASOE logs does not record the reason/origin for ABL session termination

PASOE OCTA-61492

PASOE sometimes fails to reliably start

PASOE OCTA-70008

PASOE startup warning in catalina log file caused by incorrect way of configuring default value of psc.as.https.protocol in the file conf\catalina.properties

PASOE OCTA-87393

PASSOE does not return details when a MsgFormatException is thrown, losing details on why the exception happened.

PASOE OCTA-55106

READEME files does not explicitly specify psc.as.logging.maxhistory in the logging-tomcat.properties and logging-pasoe.properties  preserves psc.as.logging.maxhistory plus 1 file including active file.

PASOE OCTA-60980

4GLTrace logging adds additional 4GLTrace logging line with truncated data if the line is long.

PASOE / PDSOE OCTA-52818

When creating an ABL WebApp project in Progress Developer Studio for OpenEdge (PDSOE), schema validation errors could appear in the Problems view for files such as oeablSecurity, referencing an unreachable spring-security.xsd schema document. These were validation warnings only and did not affect publishing or running web services; they have been resolved so they no longer appear.

PDSOE OCTA-28464

The AppBuilder perspective of the Developer Studio doesn’t generate  trigger code for ABL menu widgets.

PDSOE OCTA-94392

In PDSOE, compiling source files with non-UTF-8 characters in project startup AVM using -cpinternal UTF-8 causes runtime errors, stops the build, and requires restarting the AVM.

PDSOE OCTA-89396

Resource View in PDSOE does not display correctly

PDSOE OCTA-84172

New class creation fails when the target package name contains a hyphen (-)

PDSOE OCTA-83690

Run Configuration: Relative paths cause error on Profiler/Performance tabs (Temporary files directory) when working directory is set to “C:\”.

SQL OCTA-98078

Sustained memory growth for OpenEdge SQL Server process,  _sqlsrv2 under heavy workload triggering JAVA based UDF queries.

SQL OCTA-97396

OpenEdge SQL server crashes when “-SQLStmtCache” is set to greater than or equal to 819.

SQL OCTA-85717

When Group by and Where clause contains similar columns then Group by is optimized to use stream aggregation by reusing the selected index for query filter. If there is NULL check in Where clause on a column then incorrect results might be returned due improper copy of the index related information.

Security Vulnerabilities Addressed

The following table lists the security vulnerabilities addressed in OpenEdge 13.1:

Vulnerability CVSS 3.1/4.0 Vulnerable Artifact Action OE Components

NVD - CVE-2026-18036

NVD - CVE-2026-71888

NVD - CVE-2026-71889

NVD - CVE-2026-71891

-\-/8.2

-\-/8.7

-\-/8.7

-\-/7.1

bcprov-jdk18on-1.85.2.jar

Upgraded bcprov-jdk18on-1.85.2.jar to 1.86.

PASOE

NVD - CVE-2026-91863

NVD - CVE-2026-91864

NVD - CVE-2026-91865

NVD - CVE-2026-91866

7.5/-\-

7.5/-\-

7.5/-\-

7.5/-\-

Neethi 3.2.3

Upgraded Neethi to 3.2.4.

PASOE

NVD - CVE-2026-91776

NVD - CVE-2026-91777

7.5/-\-

7.5/-\-

Jackson databind 2.22.2

Upgraded Jackson databind to 2.22.3.

PASOE

NVD - CVE-2026-89407

NVD - CVE-2026-89425

7.5/-\-

7.5/-\-

Jackson core 2.22.2

Upgraded Jackson core to 2.22.3.

PASOE

NVD - CVE-2026-34500

NVD - CVE-2026-41293

NVD - CVE-2026-73581

NVD - CVE-2026-75973

NVD - CVE-2026-76183

NVD - CVE-2026-77756

NVD - CVE-2026-77762

NVD - CVE-2026-77791

NVD - CVE-2026-78383

NVD - CVE-2026-78437

NVD - CVE-2026-79677

NVD - CVE-2026-86248

NVD - CVE-2026-86350

NVD - CVE-2026-87022

6.5/-\-

9.8/-\-

6.5/-\-

7.3/-\-

9.8/-\-

3.7/-\-

8.1/-\-

7.5/-\-

7.5/-\-

7.3/-\-

7.5/-\-

9.8/-\-

9.1/-\-

7.5/-\-

Tomcat 11.0.25

Upgraded tomcat to 11.0.26

PASOE, Security

NVD-CVE-2026-19931

9.8/-\-

curl-8.4.0

Upgraded the curl to 8.22.0.

PASOE

NVD - CVE-2022-24795

NVD - CVE-2023-33460

7.5/-\-

6.5/-\-

yajl-c 1.0.9

Upgraded to yajl-c 2.1.0

Lang

NVD - CVE-2026-49844

5.9/-\-

Apache Log4j 2.25.0

Upgraded Apache Log4j version to 2.26.1.

OEM

NVD-CVE-2025-7962

7.5/-\-

jakarta-mail - 1.4.0

Artifact no longer used; removed.

PDSOE

NVD - CVE-2026-64607

5.3/-\-

Apache HttpClient 5.6.1

Upgraded httpclient5-cache from 5.6.1 to 5.6.4.

OEM

NVD - CVE-2026-59878

7.5/-\-

ActiveMQ 6.2.7

Upgraded ActiveMQ to 6.3.1.

OEM

NVD - CVE-2026-59889

6.5/-\-

Jackson databind 2.21.5

Upgraded jackson jars successfullly to 2.22.1.

PASOE

NVD - CVE-2026-14456

NVD - CVE-2026-14457

NVD - CVE-2026-18798

NVD - CVE-2026-54874

NVD - CVE-2026-63072

NVD - CVE-2026-63073

NVD - CVE-2026-63074

NVD - CVE-2026-63075

NVD - CVE-2026-63076

NVD - CVE-2026-75803

7.5/-\-

7.5/-\-

7.5/-\-

7.5/-\-

7.5/-\-

9.8/-\-

5.9/-\-

7.5/-\-

7.5/-\-

9.1/-\-

OpenSSL 3.5.7

Upgraded the openssl to 3.5.8.

PASOE

NVD-CVE-2026-41839

NVD-CVE-2026-41840

NVD-CVE-2026-41845

NVD-CVE-2026-41853

NVD-CVE-2026-41854

NVD-CVE-2026-22740

NVD-CVE-2026-22741

NVD-CVE-2026-22745

4.2/-

5.9/-\-

6.1/-\-

5.3/-\-

7.1/-\-

 

Spring Framework 6.2.18

Upgraded Spring to 7.0.8

OEM

NVD - CVE-2026-54225

NVD - CVE-2026-57817

NVD - CVE-2026-57818

NVD - CVE-2026-57819

NVD - CVE-2026-61466

NVD - CVE-2026-63687

NVD - CVE-2026-64958

NVD - CVE-2026-65432

NVD - CVE-2026-65583

NVD - CVE-2026-66909

NVD - CVE-2026-68079

NVD - CVE-2026-68481

7.5/-\-

8.1/-\-

8.1/-\-

7.5/-\-

9.1/-\-

9.1/-\-

7.5/-\-

7.5/-\-

9.1/-\-

9.8/-\-

9.8/-\-

7.5/-\-

Apache CXF 4.1.7

Upgraded Apache CXF from 4.1.7 to 4.1.8.

PASOE

NVD - CVE-2014-9654

NVD - CVE-2014-9911

9.8/-\-

9.8/-\-

ICU for C/C++ 4.8.1.1

Removed older ICU for C/C++ 4.8.1.1, added new ICU 78 libs.

Lang

NVD - CVE-2026-41720

7.4/-\-

spring-ldap-core-3.3.7.jar

Upgraded the spring-ldap-core jar 3.3.8

PASOE

NVD - CVE-2026-8376

9.8/-\-

Perl v5.40.4

Upgraded perl to 5.44.0

ADE, OEM, PASOE

NVD - CVE-2009-3555

NVD - CVE-2016-2108

9.8/-\-

9.8/-\-

OpenSSL 0.9.8g

Remove old legacy jar

DB

NVD-CVE-2026-54399

7.5/-\-

http-core 5.3.4 jar and http-client 5.4.4

Upgraded httpclient5  to 5.6.1 Upgraded httpcore5 to 5.4.3

PDSOE

NVD - CVE-2026-54399

NVD - CVE-2026-54428

7.5/-\-

7.5/-\-

httpcore5-5.4.2.jar

Upgraded to httpcore5-5.4.3.jar

PASOE

NVD - CVE-2026-54512

NVD - CVE-2026-54513

8.1/-\-

8.1/-\-

jackson-databind-2.21.2

Upgraded the jackson jar to 2.21.5.

PDSOE

NVD-CVE-2026-9828

NVD-CVE-2026-10532

/-\-

logback-classic-1.5.32.jar

Upgraded the logback-classic to 1.5.37

OEM

NVD - CVE-2026-10532

NVD - CVE-2026-9828

-\-/2.9

-\-/2.9

Logback 1.5.32

Upgraded from 1.5.32 to 1.5.37.

PASOE

NVD - CVE-2026-6857

7.5/-\-

Apache Camel 4.18.2

Upgraded from 4.18.2 to 4.18.3.

PASOE

NVD - CVE-2026-34182

NVD - CVE-2026-42766

NVD - CVE-2026-42768

NVD - CVE-2026-42769

NVD - CVE-2026-42770

NVD - CVE-2026-45445

NVD - CVE-2026-45446

NVD - CVE-2026-45447

NVD - CVE-2026-7383

NVD - CVE-2026-9076

9.1/-\-

5.9/-\-

3.7/-\-

5.3/-\-

3.7/-\-

7.5/-\-

4.8/-\-

8.8/-\-

8.1/-\-

7.5/-\-

OpenSSL 3.5.5

Upgarded the openssl to version 3.5.7.

PASOE

NVD - CVE-2026-43827

NVD - CVE-2026-43828

NVD - CVE-2026-44598

NVD - CVE-2026-48589

NVD - CVE-2026-49268

6.5/-\-

6.5/-\-

5.4/-\-

5.4/-\-

9.1/-\-

Apache Shiro 2.1.0

upgraded Apache Shiro to 2.2.1

PASOE

NVD - CVE-2026-45292

7.5/-\-

opentelemetry-api-1.51.0.jar

Upgraded from 1.51.0 to 1.62.0.

PDSOE

NVD - CVE-2026-45447

8.8/-\-

OpenSSL 3.5.6

Upgraded OpenSSL to 3.5.7

SQL

NVD - CVE-2026-44417

NVD - CVE-2026-44618

NVD - CVE-2026-44930

7.5/-\-

5.3/-\-

9.8/-\-

Apache cxf 4.1.5

Upgraded Apache CXF to 4.1.6.

PASOE

NVD - CVE-2026-22732

9.1/-\-

Spring-security 6.5.6

Upgraded spring-security to 6.5.9

PASOE

NVD - CVE-2026-45447

8.8/-\-

OpenSSL 3.0.20

Removed OpenSSL 3.0.20

SQL

NVD - CVE-2026-34477

NVD - CVE-2026-34478

NVD - CVE-2026-34479

NVD - CVE-2026-34480

5.9/-\-

7.5/-\-

7.5/-\-

7.5/-\-

log4j-core-2.25.3.jar

Upgraded the log4j jars to 2.26.0

OEM

NVD - CVE-2026-22740

NVD - CVE-2026-22741

NVD - CVE-2026-22745

6.5/-\-

3.1/-\-

5.3/-\-

Spring Framework 6.2.17.jar

Upgraded  spring jar from 6.2.17 to 6.2.18

PASOE

NVD - CVE-2025-15467

9.8/-\-

OpenSSL 3.0.16

Upgraded OpenSSL 3.0.20 and 3.5.5

SQL, DataServers-MSSQLSRV

NVD - CVE-2026-40466

NVD - CVE-2026-41043

NVD - CVE-2026-41044

8.8/-\-

6.5/-\-

8.8/-\-

ActiveMQ 6.2.4

Upgraded from 6.2.4 to 6.2.5.

OEM

NVD - CVE-2025-66168

8.8/-\-

ActiveMQ 6.2.5

Upgraded ActiveMQ to 6.2.7

OEM

NVD-CVE-2018-8046

NVD-CVE-2007-6758

6.7/-\-

Ext JS 3.4.1.1

It removes old Ext JS

OEM

NVD - CVE-2025-66168

8.8/-\-

ActiveMQ 6.2.0

Upgraded from 6.2.0 to 6.2.4.

OEM

NVD - CVE-2026-22735

NVD - CVE-2026-22737

2.6/-\-

5.9/-\-

Spring Framework 6.2.14

Upgraded spring jar from 6.2.14 to 6.2.17.

PASOE

NVD - CVE-2023-33201

NVD - CVE-2024-30172

5.3/-\-

7.5/-\-

bcprov-jdk18on-1.78.1.jar

Upgraded bcprov-jdk18on to 1.84

PASOE

NVD - CVE-2026-22735

NVD - CVE-2026-22737

NVD - CVE-2026-22740

NVD - CVE-2026-22741

NVD - CVE-2026-22745

2.6/-\-

5.9/-\-

6.5/-\-

3.1/-\-

5.3/-\-

Spring-FrameWork 6.2.14

Upgraded the spring to 6.2.18

OEM

NVD-CVE-2023-45853

9.8/-\-

zlib 1.3.1

Upgraded  Zlib to 1.3.2

Lang

NVD - CVE-2025-66614

NVD - CVE-2026-24733

NVD - CVE-2026-24734

9.1/-\-

3.7/-\-

7.5/-\-

Tomcat 10.1.48

Upgraded the tomcat to 10.1.54.

PASOE

NVD - CVE-2025-66169

NVD - CVE-2026-23552

NVD - CVE-2026-25747

5.3/-\-

9.1/-\-

8.8/-\-

camel-api-4.16.0.jar

Upgraded camel-api to 4.18.2

PASOE

NVD - CVE-2026-23903

5.3/-\-

shiro-web-2.0.5-jakarta.jar

Upgraded from 2.0.5 to 2.1.0.

OEM

NVD - CVE-2025-12183

NVD - CVE-2025-66566

-\-/8.8

-\-/8.2

lz4-java-1.8.0.jar

Upgraded from 1.8.0 to 1.10.1.

OEM

NVD-CVE-2024-23807

NVD-CVE-2023-37536

NVD-CVE-2018-1311

9.8/-\-

8.8/-\-

8.1/-\-

apache/xerces-c 3.2.3

Upgraded Xerces from 3.2.3 to 3.3.0.

Lang

NVD - CVE-2025-48924

5.3/-\-

commons-lang3-3.9.jar

Upgraded commons-lang3 to 3.20.0

PDSOE

NVD - CVE-2025-68161

4.8/-\-

log4j-core-2.23.1.jar

Updated the log4j-core to 2.25.3

OEM

NVD - CVE-2025-11226

-\-/7.0

logback-classic-1.5.18.jar

Upgraded logback-classic to 1.5.32

PASOE

NVD - CVE-2020-13956

5.3/-\-

httpclient-4.5.10.jar

Upgraded to httpclient5 5.6.1

Sonic ESB Adapter

NVD - CVE-2023-5763

9.8/-\-

expressly jar version 5.0.0

Upgraded the expressly  to 6.0.0

PASOE

NVD - CVE-2021-46708

6.1/-\-

swagger-ui-3.52.5.jar

Upgraded swagger-ui to 4.x.

PASOE