9-22-2022 – Updated statements regarding SAS® Viya® 3.5 and SAS® Viya® 3.4   See the full bulletin: https://support.sas.com/content/support/en/security-bulletins/remote-code-execution-vulnerability-cve-2021-44228.html  ... View more

5-5-2022 – Updated statements regarding SAS® Life Science Analytics Framework Read the full bulletin. ... View more

3-11-2022 – Updated statement regarding recommendations for SAS® Viya® 3.5 and SAS® Viya® 3.4. Read the full bulletin. ... View more

3-10-2022 – Updated statement regarding recommendation for SAS® Viya® 2020.1 and later; added links to SAS Help Center for update steps for SAS® Viya® 2020.1 and later, SAS® Viya® 3.5, and SAS® Viya® 3.4   Read the full bulletin. ... View more

2-24-2022 – Updated statement regarding completion of delivery of patches for SAS® Viya® 2020.1 and later; updated recommendations for SAS® Risk Management Solutions on SAS® Viya® regarding Apache Solr   Read the full bulletin. ... View more

Most recent update: 01-25-2022 (3:00 PM EST) – Updated recommendations for SAS® Data Management Studio and Server  Read the full updated bulletin. ... View more

Most recent update: 1-21-2022 (3:00 PM EST) – Addition of related vulnerability, CVE-2022-23307; updated recommendations for SAS® Life Science Analytics Framework  Read the full updated bulletin. ... View more

Most recent updates:   01-14-2022 (5:00 PM EST) – Removal of product-specific steps for SAS® Visual Investigator that were referenced in the recommendations for other products and solutions; updated recommendations for SAS® Enterprise Session Monitor and SAS® Risk Management Solutions (SAS Viya)  Read the full updated bulletin. ... View more

Most recent update: 1-11-2022 (5:00 PM EST) - Guidance for deployments that provide access from Base SAS® to Hadoop; updated recommendations for SAS® Visual Investigator; detailed evaluations and recommendations for SAS® Data Loader for Hadoop, SAS® Scalable Performance Data Engine, and SAS/ACCESS®  Read the full updated bulletin. ... View more

Most recent update: 1-6-2022 (5:00 PM EST) - Guidance for SAS® Viya 2020.1 and later deployments containing Open Distro for Elasticsearch; updated recommendations for SAS® Anti-Money Laundering,  SAS® Customer Due Diligence, and SAS® Life Science Analytics Framework  Read the full updated bulletin. ... View more

Most recent update: 1-4-2022 (6:00 PM EST) - Mapping of mitigation and remediation measures to specific Log4j CVEs; plans for delivery of Log4j versions 2.17.1+; detailed evaluation and recommendation for SAS® 9 Content Assessment Read the full updated bulletin. ... View more

Most recent update: 12-28-2021 (5:30 PM EST) - Addition of related vulnerability, CVE-2021-44832 Read the full updated bulletin. ... View more

Most recent updates: 12-24-2021 (12:00 PM EST) - Automated approach to remediation on SAS® Viya® 3.x (loguccino) with corresponding adjustments in guidance and instructions; plans for updating to Log4j 2.17; detailed evaluations and recommendations for SAS® Analytics Accelerator for Teradata, SAS® Data Management Studio and Server, SAS® Data Quality Accelerators, SAS® Grid Manager, SAS® In-Database Technologies, SAS® Scoring Accelerators, SAS® Visual Analytics, and SAS® Visual Analytics Apps   Read the full updated bulletin. ... View more

Today's bulletin update for the Remote Code Execution Vulnerability (CVE-2021-44228) is delayed until tomorrow morning, due to substantial changes that are being finalized. Instead, there will be a significant update to the guidance in the bulletin tomorrow, 12-24-2021 at 12:00 PM EST. ... View more

Most recent updates: 12-22-2021 (9:00 PM EST) - Automated approach to remediation on SAS® 9.4 (Loguccino), removal of JndiLookup class on server vs client machines, detailed evaluations and recommendations for SAS® API for ThreatMetrix Offerings, SAS® Campaign Management, SAS® Clinical Trial Data Transparency, SAS® Continuous Monitoring Offerings, SAS® Customer Intelligence 360 Discover, SAS® Customer Intelligence 360 Engage: Digital, SAS® Customer Intelligence 360 Engage: Direct, SAS® Customer Intelligence 360 Engage: Email, SAS® Customer Intelligence 360 Engage: Optimize, SAS® Customer Intelligence 360 Match, SAS® Customer Intelligence 360 Plan, SAS® Detection and Investigation Offerings, SAS® Financial Crimes Analytics (on SAS® Viya®), SAS® Life Science Analytics Framework 5.4, SAS® Life Science Analytics Framework APIs and Extensions, SAS® Marketing Automation, SAS® Marketing Optimization, SAS® Orchestration Adapters, and SAS® Real-Time Decision Manager  Next update expected: 12-23-2021 (approximately 6:00 PM EST)   Read the full updated bulletin. ... View more