CA Client Automation: Log4j 2.25.3 Vulnerability Remediation

Products

• CA Client Automation - IT Client Manager

Issue/Introduction

CA Client Automation 14.6 uses log4j 2.25.3 and this version of log4j has some vulnerabilities. While Broadcom DEV will pack newer version like 2.25.4 in next release, CA Client automation administrators can manually upgrade log4j to 2.25.4.

For example, both

D:\Program Files (x86)\CA\DSM\Web Console\webapps\pmengine.war

and

D:\Program Files (x86)\CA\DSM\Web Console\webapps\pmengine\WEB-INF\lib\log4j-core-2.25.3.jar

have log4j 2.25.3. We will give some manual steps to upgrade the log4j version to 2.25.4 in this article. for other jar and war files, administrators can follow the same steps.

Environment

• CA Client Automation 14.6

Cause

Log4j 2.25.3 has some vulnerabilities. For example, CVE-2026-34480

Resolution

For the jar file(s), please follow these steps:

1. Stop the Tomcat service: caf stop tomcat
2. Navigate to the WEB-INF\lib directories of the affected webapps(webapps\AMS\WEB-INF\lib, webapps\pmengine\WEB-INF\lib, webapps\wac\WEB-INF\lib\ ) and move the existing log4j--2.25.3.jar/log4j-_2.24.1.jar files to a backup directory.
3. Copy the newer version of applicable log4j2 JARs (e.g., log4j-api-2.25.4.jar, log4j-core-2.25.4.jar, etc.) into those same directories.
4. Start the Tomcat service: caf start tomcat

For the war file, please follow these steps(backup the entire CA\\DSM\\Web Console\\webapps directory first, then):

1. Stop the Tomcat Service: Open an Administrator Command Prompt and run: caf stop tomcat

2. Rename the WAR files to ZIP:

3. Open Windows File Explorer and navigate to DSM\\Web Console\\webapps\\.
4. Right-click wac.war and rename it to wac.zip. (If Windows warns you that changing a file extension might make it unusable, click Yes to confirm).
5. Right-click pmengine.war and rename it to pmengine.zip.
6. Update the JARs inside the Archives:

7. Double-click wac.zip to open it in Windows Explorer just like a normal folder.
8. Navigate into the WEB-INF\\lib folder inside the zip.
9. Delete the old log4j-api-2.25.3.jar, log4j-jcl-2.25.3.jar and log4j-core-2.25.3.jar files.
10. Drag and drop (or Copy/Paste) the new Log4j 2.25.4 JARs into this window. Windows will automatically update the compressed archive.
11. Repeat this exact same process for pmengine.zip.
12. Restore the WAR Extension:

13. Navigate back to the webapps folder.
14. Rename wac.zip back to wac.war.
15. Rename pmengine.zip back to pmengine.war.
16. Patch the Exploded Directories:

17. To ensure Tomcat doesn't run from an outdated cache, copy the new 2.25.4 JAR files directly into the extracted directories as well:
webapps\wac\WEB-INF\lib
webapps\pmengine\WEB-INF\lib
webapps\AMS\WEB-INF\lib
Ensure you delete the old 2.25.3 JARs from these folders.
18. Start Tomcat: caf start tomcat

Additional Information

Log4j 2.25.4