SiteMinder : Log4j Vulnerabilities CVE-2026-34477 , CVE-2026-34478 , CVE-2026-34480.

Products

• SITEMINDER

Issue/Introduction

The following Log4j vulnerabilities are reported in the SiteMinder Policy Server , AdminUI and Access Gateway.

CVE	Description	Impact
CVE-2026-34478	Log injection in Rfc5424Layout due to undocumented renames of security-relevant configuration attributes.	Medium
CVE-2026-34480	XmlLayout fails to sanitize characters forbidden by XML 1.0, leading to silent log event loss or invalid XML output.	Medium
CVE-2026-34477	Hostname verification (verifyHostName) was silently ignored in certain TLS configurations, bypassing intended security checks.	Medium

Environment

SiteMinder version : 12.9 and older.

Components : PS , AdminUI , Access Gateway

Cause

These Vulnerabilites seen after applying the Current KB reference which only addresses 2.25.3 

 https://knowledge.broadcom.com/external/article/427360/vulnerability-in-log4j-2252-and-older-on.html

Resolution

Reasoning  :

The Log4j vulnerabilities CVEs CVE-2026-34478, CVE-2026-34480, CVE-2026-34477  would be exploited if the socket connections are enabled in Log4j jars to send logs over encrypted TLS connections via  Socket, or Syslog appends. In this case a network based attacker could intercept or modify log data, however, sending logs over the TLS through a socket is not enabled in SiteMinder components by default.

Conclusion

These vulnerabilities for Log4j "CVE-2026-34478, CVE-2026-34480, CVE-2026-34477" do not impact the SiteMinder Policy Server, AdminUI or Access Gateway components.