Vulnerability Scan reports Apache Tomcat CVEs in Applications Manager

Products

• Automic Applications Manager

Issue/Introduction

Vulnerability scans may flag CA Automic Applications Manager (AM) for several Apache Tomcat-related vulnerabilities, including:

• CVE-2026-34483
• CVE-2026-34486
• CVE-2026-34487
• CVE-2026-34500
• CVE-2026-41284

Environment

CA Automic Applications Manager (AM) version 9.6 to 9.6.1

Cause

Applications Manager packages the tomcat-embed-el library, which is the Apache implementation for Javax EL (Expression Language). However, AM does not use Apache Tomcat as its web server engine. Security scanners often flag these libraries based on version signatures alone, regardless of whether the specific vulnerable code paths are utilized by the application.

Applications Manager is not exploitable for these CVEs because the required Tomcat components (such as the core web server engine, WebDAV servlet, or HTTP/2 mechanisms) are not used in the AM architecture.

Resolution

The following CVEs are not exploitable in AM:

• CVE-2026-34483 / CVE-2026-41284: AM does not run the WebDAV servlet or core Tomcat engine.
• CVE-2026-34486: AM does not use Tomcat's HTTP/2 implementation.
• CVE-2026-34487: AM does not utilize Tomcat's native WebSocket client wrapper.
• CVE-2026-34500: AM does not deploy AJP connectors.

Remediation: Broadcom recommends upgrading to Applications Manager 9.6.2 or higher. This release migrates the embedded web server architecture from Apache Tomcat to Jetty, which permanently removes the flagged Tomcat libraries from the installation.

Whitelisting: For environments on 9.6.x prior to 9.6.2, these libraries can be safely whitelisted in security scanning tools as the vulnerable code paths are not utilized.