CVE-2026-49844 for Log4J 2.25.4 on SiteMinder Components

Products

• SITEMINDER
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)

Issue/Introduction

SiteMinder bundles Apache Log4J2 in a number of components, including the Policy Server, AdminUI, Access Gateway Server, Web Agents and the SDK.  The most current version of Log4J for Siteminder Components is Log4J 2.25.4.

Environment

PRODUCT: Symantec SiteMinder

COMPONENTS:

Policy Server: r12.9 and older
Policy Server OS: Any

Siteminder AdminUI: r12.9 and older
AdminUI OS: Any

Access Gateway: r12.9 and older
Access Gateway OS: Any

Application Server Agents (ASA): r12.8.7 & r12.8.8
Access Gateway OS: Any

Siteminder SDK: 12.9 and older
SDK OS: Any

Siteminder Web Agent: r12.8 and older
OS: Any

Cause

The following CVE was released for Log4J 2.25.4 and older.

CVE-2026-49844

DESCRIPTION: Improper serialization of non-finite floating-point values in MapMessage.asJson()

SEVERITY: Medium
IMPACTED: Log4J 2.25.4
REMEDIATED: 2.25.5

Resolution

Security Analysis for CVE-2026-49844 on Symantec SiteMinder Components

Determination: SiteMinder components are NOT IMPACTED by CVE-2026-49844.

Why SiteMinder is Not Vulnerable:

CVE-2026-49844 is a specific issue in Apache Log4j API that occurs only when an application meets both of these strict runtime conditions:

It uses Log4j's JsonTemplateLayout (JSON logging format).

It logs structured MapMessage objects containing floating-point values.

SiteMinder exclusively uses standard PatternLayout across all components (Policy Server, WAMUI/WebAdmin, Access Gateway, FWS). JsonTemplateLayout is never used.
SiteMinder code contains no calls to MapMessage.asJson() or MapMessage objects.

Any flag raised by security scanners (e.g., Qualys, Snyk, Veracode, Nessus, etc) on log4j-api-2.17.x.jar is a version-based False Positive, as the vulnerable code path cannot be invoked in SiteMinder.

Additional Information

KB 438214 Vulnerability in Log4j 2.25.3 And Older on Siteminder Application Server Agents (ASA)

KB 438213 Vulnerability in Log4j 2.25.3 And Older on Siteminder SDK

KB 438210 Vulnerability in Log4j 2.25.3 And Older on Siteminder AdminUI

KB 438208 Vulnerability in Log4j 2.25.3 and Older on Siteminder Access Gateway

KB 438204 Vulnerability in Log4j 2.25.3 And Older on the Siteminder Policy Server