NOTE:  This Advisory supercedes the  Pega Security Advisory for Apache Log4j Zero Day Vulnerability.

The following vulnerabilities have been identified in Apache Log4j 2 logging software:

These vulnerabilities could allow malicious actors to take control of organizational networks using Log4j. The Log4j software is ubiquitously used by most organizations around the world.  

For detailed information about the vulnerability and its potential impact on Pega software, see Security Advisory: Apache Log4j Zero Day Vulnerability.

Pega has created hotfixes based on Apache Log4j 2.17 for each Platform version to address the three vulnerabilities listed above. 

Pega Cloud® environments running the relevant Pega versions are being proactively remediated by Pega. If you are running Pega Platform software in an on–premises or client-managed cloud environment, please review the table below to determine which hotfix corresponds to your Pegasystems installation, and install the appropriate version of this hotfix as soon as possible.  (A hotfix for our Stream service [Kafka] is available separately. See this post for more information.)

NOTE:  All on-premises or client-managed cloud clients should apply this latest Pega Platform service hotfix, even if they had applied an earlier Pega Platform service hotfix, as this hotfix addresses all the above vulnerabilities.

Once you have determined the appropriate hotfix ID, please submit a hotfix request using My Support Portal. 

As always, we recommend our clients review our Security Checklist regularly.

8.X: