Severity: High

Description: SAS Studio Basic on SAS^® 9.4M8 (TS1M8) and SAS^® 9.4M9 (TS1M9) contains multiple libraries with known vulnerabilities.

com.fasterxml.jackson.core

• GHSA-72hv-8253-57qq

org.springframework:spring-webmvc

• CVE-2024-38816
• CVE-2024-38819
• CVE-2024-38820
• CVE-2024-38828
• CVE-2026-22735
• CVE-2026-22737

org.springframework.security:spring-security-web

• CVE-2026-22732

org.apache.logging.log4j:log4j-core

• CVE-2025-68161

Potential Impact: This vulnerability might allow Denial of Service. See the GHSA and CVE records for additional information.