Log4j 2.25.4 Hotfixes for CA Identity Suite (14.5.1 CHF2)

Products

• CA Identity Suite
• CA Identity Governance
• CA Identity Manager
• CA Identity Portal

Issue/Introduction

Security scans indicate that Identity Manager and Governance (IGA components) are impacted by a Log4j vulnerability (CVE-2026-34477).

Environment

• Products: Identity Manager, Identity Governance, Identity Portal, Virtual Appliance
• Version: 14.5.1 CHF2
• Installed Log4j: 2.25.3
• Required Log4j: 2.25.4

Cause

The vulnerability was identified in the Log4j 2.25.3 library utilized by various IGA components.

Resolution

Engineering has released specific hotfixes to update Log4j to version 2.25.4. These patches should be applied on top of the 14.5.1 CHF2 release.

Download Links

Refer to the following release note pages for the relevant hotfix downloads:

• Identity Portal (IP): https://support.broadcom.com/web/ecx/solutiondetails?aparNo=99112760&os=MULTI-PLATFORM
• Identity Governance (IG): https://support.broadcom.com/web/ecx/solutiondetails?aparNo=99112761&os=MULTI-PLATFORM
• Identity Manager (IM): https://support.broadcom.com/web/ecx/solutiondetails?aparNo=99112759&os=MULTI-PLATFORM
• Virtual Appliance (vApp): https://support.broadcom.com/web/ecx/solutiondetails?aparNo=99112762&os=COS