Process Automation (ITPAM) Not Affected by Log4j CVE-2026-34477

Products

• CA Process Automation Base
• Process Automation Manager

Issue/Introduction

Scanners may flag CA Process Automation (ITPAM) for CVE-2026-34477, a vulnerability in Apache Log4j (2.17.2 and earlier) related to broken TLS hostname verification in specific appenders. Customers often inquire if this vulnerability poses a risk to their ITPAM environment.

Environment

• Product: CA Process Automation (ITPAM)
• Version: 4.4 and earlier
• Component: Logging (Log4j)

Cause

According to the official description for CVE-2026-34477, a network-based Man-in-the-Middle (MitM) attacker can only exploit this flaw if all of the following conditions are met:

1. An SMTP, Socket, or Syslog appender is actively configured and in use.
2. TLS is explicitly configured via a nested <Ssl> element inside that appender.

Resolution

Broadcom Engineering has confirmed that CA Process Automation is not affected by CVE-2026-34477. This is considered a false positive for the following reasons:

Default Configuration Analysis

ITPAM utilizes only two active appenders in its default configuration (log4j2.xml):

• <Console name="CONSOLE">: Outputs directly to standard out/server logs.
• <RollingFile name="C2OFILE">: Writes directly to the local disk at c2o.log.

Mitigation Details

• No Network Appenders: ITPAM does not send logs over the network via Log4j's built-in SMTP, Socket, or Syslog handlers.
• No TLS Vulnerability: Because these appenders are not used, the application never establishes the TLS connections prone to hostname verification failure.

Additional Information

While the current configuration is safe and not exploitable, Broadcom plans to upgrade the Log4j library that is not affected by this vulnerability, release level TBD.

See also:  Process Automation Not Affected by Log4j CVE-2026-34480 and CVE-2026-34479