SAS® Web Application Server 9.48 (SAS® 9.4 TS1M8) hot fixes address security vulnerabilities


Severity: Critical/High/Medium/Low

Description: SAS Web Application Server 9.48 hot fixes address the following security vulnerabilities. These hot fixes are cumulative; therefore, only the most recent hot fix is required to address all vulnerabilities listed below.

See SAS KB0046220 for the current supported Apache HTTP Server (httpd), OpenSSL and Apache Tomcat versions in SAS® 9.4.

 

Addressed in hot fix M3P012

CVE-2026-24880CVE-2026-25854CVE-2026-29129CVE-2026-32990CVE-2026-34483
CVE-2026-34486CVE-2026-41284CVE-2026-41293CVE-2026-42253CVE-2026-42498
CVE-2026-42588CVE-2026-43512CVE-2026-43513CVE-2026-43514CVE-2026-43515
CVE-2026-43827CVE-2026-43828CVE-2026-45505CVE-2026-46605CVE-2026-49270
CVE-2026-49432CVE-2026-49434CVE-2026-50229CVE-2026-50734CVE-2026-53404
CVE-2026-53434CVE-2026-53916CVE-2026-53917CVE-2026-54475CVE-2026-54512
CVE-2026-54513CVE-2026-54514CVE-2026-54515CVE-2026-54516CVE-2026-54517
CVE-2026-54518CVE-2026-55276CVE-2026-55955CVE-2026-55956CVE-2026-59889

 

Addressed in hot fix M3P011

CVE-2025-66614CVE-2025-66168CVE-2026-24733CVE-2026-24734CVE-2026-29145
CVE-2026-29146CVE-2026-33227CVE-2026-34197CVE-2026-34487CVE-2026-34500
CVE-2026-39304CVE-2026-40466CVE-2026-41043CVE-2026-41044 

 

Addressed in hot fix M3P010

CVE-2020-11971CVE-2024-38816CVE-2024-38819CVE-2024-38820CVE-2024-38828
CVE-2025-41242CVE-2025-41249CVE-2025-55754CVE-2025-68161CVE-2026-23901
CVE-2026-23903    

 

Addressed in hot fix M3P009

CVE-2025-48989CVE-2025-55752CVE-2025-55754CVE-2025-61795

 

Addressed in hot fix M3P008

CVE-2025-27533CVE-2025-46701CVE-2025-48976CVE-2025-48988CVE-2025-49124
CVE-2025-49125CVE-2025-52434CVE-2025-52520CVE-2025-53506 

 

Addressed in hot fix M3P007

CVE-2020-11971CVE-2024-6763CVE-2024-8184CVE-2024-38808CVE-2024-38809
CVE-2024-38816CVE-2024-38819CVE-2024-38820CVE-2024-38828CVE-2024-47072
CVE-2025-24813    

 

Addressed in hot fix M3P006

CVE-2024-52316

 

Addressed in hot fix M3P005

CVE-2020-11971CVE-2022-45143CVE-2023-35116CVE-2023-46589CVE-2023-46749
CVE-2023-46750CVE-2024-22243CVE-2024-22259CVE-2024-23672CVE-2024-34750

 

Addressed in hot fix M3P004

CVE-2024-23672CVE-2024-24549

 

Addressed in hot fix M3P003

CVE-2023-41080CVE-2023-42794CVE-2023-42795CVE-2023-44487CVE-2023-45648
CVE-2023-46589    

 

Addressed in hot fix M3P002

CVE-2023-46604

 

Addressed in hot fix M3P001

CVE-2023-24998


Potential Impact: See the CVE records for additional information.