After you apply the sas-security-update-2026-03-M8 hot fix, the appsrvconfig.sh script that is used to deploy and undeploy SAS Web Applications might stop working and return the following error: 

[user@hostname sas]$ /Lev1/Web/Scripts/AppServer/appsrvconfig.sh
Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/logging/log4j/LogManager
at com.sas.appserver.scripting.AbstractScriptDriver.<clinit>(AbstractScriptDriver.groovy:53)
Caused by: java.lang.ClassNotFoundException: org.apache.logging.log4j.LogManager
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass
(BuiltinClassLoader.java:581)
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass
(ClassLoaders.java:178)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
... 1 more

Note: For additional information about the appsrvconfig.sh script, see Scripting Tool for SAS Web Application Server.

The issue is caused by hardcoded log4j-api-2.17.2.jar log4j-core-2.17.2.jar JAR fiels in the appsrvconfig.sh classpath inside the CLASSPATH definition: 

[user@hostname sas]$ cat "/opt/sas/conf-mid/Lev1/Web/Scripts/AppServer/appsrvconfig.sh" | grep log4j
CLASSPATH=.........../opt/sas/conf-mid/Lev1/Web/Scripts/AppServer/lib/log4j-api-2.17.2.jar: ....... /opt/sas/conf-mid/Lev1/Web/Scripts/AppServer/lib/log4j-core-2.17.2.jar:

 log4j has been upgraded to 2.25.3, and 2.17.2 JAR no longer exists.

Workaround

To circumvent this issue, update appsrvconfig.sh so that the paths reflect the new jar file version for the log4j-api and log4j-core jar files.