Severity: High

Description: SAS Web Application Server on SAS^® 9.4M8 (TS1M8) and SAS^® 9.4M9 (TS1M9) contains versions of Tomcat and ActiveMQ that are known to be affected by the following vulnerabilities:

SAS 9.4M8

• CVE-2025-66168
• CVE-2026-33227
• CVE-2026-34197
• CVE-2026-39304
• CVE-2026-40466
• CVE-2026-41043
• CVE-2026-41044
• CVE-2026-24734
• CVE-2026-24733
• CVE-2025-66614
• CVE-2026-24734
• CVE-2026-24733
• CVE-2025-66614

SAS 9.4M9

• CVE-2026-33227
• CVE-2026-39304
• CVE-2026-24734
• CVE-2026-24733
• CVE-2025-66614
• CVE-2026-33453

Potential Impact: See the CVE records for additional information.