Avaya Experience Portal R 8.1.2 Service Pack 4 includes the following changes:

Platform Updates

The Experience Portal platform has undergone significant upgrades to enhance performance, stability, and security:

  • JDK: Upgraded to Azul Zulu OpenJDK 17.0.20.1 for enhanced security and LTS support.

Security Updates

New security measures for Experience Portal are the following:

Apache Tomcat Upgrade: In this release, we introduced Apache Tomcat 10.1.x while maintaining Apache Tomcat 9.0.x to support WebLM v 8.1.

  • Apache Tomcat 10.1.60: Upgraded Apache Tomcat to 10.1 to incorporate security and stability fixes included in Apache Tomcat 10.1.60, along with improved compatibility with Java 17 and Jakarta-based application components.

  • Apache Tomcat 9.0.122: Upgraded to 9.0.122 to resolve the following security vulnerabilities:

    • CVE-2026-73180 - Authenticated WebSocket session survives end of HTTP session, allowing persistent connection lifecycle bypass.

    • CVE-2026-68763 - DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset.

    • CVE-2026-68569 - Principal lookup could fail open in some authentication methods (For example, CLIENT-CERT, SPNEGO), resulting in improper user authentication.

    • CVE-2026-68525 - Redirect after FORM authentication may bypass method-specific security constraints.

    • CVE-2026-66422 - Servlet role references can bypass declarative role constraints due to incorrect usage in Realms.

    • CVE-2026-66299 - DoS in WebSocket chat example due to unbounded message buffer leading to memory exhaustion.

    • CVE-2026-65927 - RewriteValve [N] flag restarts at the second rule instead of the first, potentially bypassing access control.

    • CVE-2026-65905 - Limited replay attack possible with DIGEST authentication when nonceCount reaches upper window boundary.

    • CVE-2026-65637 - HTTP/2 no-authority bypass of strict SNI validation.

    • CVE-2026-65183 - TOCTOU race condition when setting specific permissions for Unix Domain Sockets.

    • CVE-2026-65182 - Security constraint bypass if a longer path constraint is defined prior to a shorter sub-path constraint.

    • CVE-2026-59084 - EncryptInterceptor requirements not clearly documented, leading to potential encryption misconfiguration.

    • CVE-2026-59083 - Incorrect Uniform Resource Locator (URL) decoding in RewriteValve may allow security control bypass.

    • CVE-2026-55956 - Security constraints for default servlet ignored method or method omission.

    • CVE-2026-55955 - EncryptInterceptor not protected against replay attacks despite documentation claims.

    • CVE-2026-55276 - Logged effective web.xml is incomplete, causing omission of special roles and empty authorization constraints.

    • CVE-2026-53434 - Invalid CRL configuration does not trigger failure for FFM Connector, bypassing certificate revocation validation.

    • CVE-2026-53404 - Bad ornext processing in RewriteValve allowing improper request handling and condition skipping.

    • CVE-2026-50229 - Cross-Site Scripting (XSS) in number guess example due to wildcard property mapping.

    • CVE-2026-43515 - Security constraints not correctly applied when multiple constraints define HTTP method rules for the same extension pattern.

    • CVE-2026-43514 - AJP secret compared in non-constant time, exposing local networks to timing attacks.

    • CVE-2026-43513 - LockOutRealm treats user names as case-sensitive, weakening brute force protections.

    • CVE-2026-43512 - Digest authenticator will authenticate any unknown user if presented with a null password.

    • CVE-2026-42498 - WebSocket authentication header exposure to target host following a redirect.

    • CVE-2026-41293 - HTTP/2 request headers not validated prior to exposing via Servlet API.

    • CVE-2026-41284 - Unbounded read in WebDAV LOCK and PROPFIND handling leading to potential resource exhaustion.

    • CVE-2026-34500 - OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled during CLIENT_CERT authentication.

    • CVE-2026-34487 - Cloud membership for clustering component exposed Kubernetes bearer token in log messages.

    • CVE-2026-34486 - Incomplete fix for CVE-2026-29146 allowed bypass of EncryptInterceptor.

    • CVE-2026-34483 - Incomplete escaping of JSON access logs when custom relaxed path/query characters are configured.

    • CVE-2026-32990 - Incomplete fix for CVE-2025-66614 allowing case-sensitivity bypass of strict SNI checks.

    • CVE-2026-29146 - EncryptInterceptor vulnerable to padding oracle attack due to default CBC mode.

    • CVE-2026-29145 - OCSP checks soft-fail even when soft-fail is explicitly disabled during CLIENT_CERT verification.

    • CVE-2026-29129 - Configured TLS cipher preference order not preserved when adding TLS 1.3 cipher suite configuration.

    • CVE-2026-25854 - Open redirect vulnerability via crafted URL when LoadBalancerDrainingValve node is in draining state.

    • CVE-2026-24880 - Request smuggling via invalid chunk extension containing unvalidated CRLF sequences.

    • CVE-2026-24734 - Incomplete OCSP verification checks when using FFM integration with OpenSSL.

    • CVE-2026-24733 - Security constraint bypass on GET requests via invalid HTTP/0.9 HEAD requests.

    • CVE-2025-66614 - Client certificate verification bypass due to hostname mismatch between SNI extension and HTTP host header.

    • CVE-2025-61795 - Delayed cleaning of multipart upload temporary files leading to potential DoS.

    • CVE-2025-55754 - Console manipulation via terminal escape sequences injected into log messages.

    • CVE-2025-55668 - Session fixation vulnerability possible via rewrite valve when victim interacts with crafted URL.

    • CVE-2025-52434 - APR/Native Connector crash leading to JVM crash and Denial of Service on connection close.

    • CVE-2025-49125 - Security constraint bypass for PreResources and PostResources mounted outside application root.

    • CVE-2025-49124 - Untrusted search path vulnerability allowing DLL side-loading via Tomcat installer for Windows.

    • CVE-2025-48989 - DoS in HTTP/2 stream management triggered by client stream resets.

    • CVE-2025-48988 - Excessive memory usage and DoS caused by handling large numbers of parts in multipart requests.

    • CVE-2025-48976 - Excessive memory usage and DoS in Apache Commons FileUpload due to large headers in multipart requests.

  • ActiveMQ: Upgraded to 6.3.2 to resolve the following security vulnerabilities:

    • CVE-2026-74761 - Authorization Bypass via clientId Spoofing.

    • CVE-2026-50750 - ActiveMQ broker messaging vulnerability fixed in the 6.2.x maintenance branch.

    • CVE-2026-49877 - ActiveMQ broker messaging vulnerability fixed in the 6.2.x maintenance branch.

    • CVE-2026-42588 - ActiveMQ broker messaging vulnerability fixed in the 6.2.x maintenance branch.

    • CVE-2026-34197 - Apache ActiveMQ Remote Code Execution (RCE) vulnerability allowing arbitrary code execution on the broker JVM.

    • CVE-2025-66168 - Improper validation of MQTT "Remaining Length" field causing integer overflow and unexpected broker behavior.

  • Apache Log4j: Upgraded to 2.26.1 to resolve the following security vulnerabilities:

    • CVE-2026-49844 - Logging framework security vulnerability resolved in Log4j 2.26.1.

    • CVE-2026-34481 - Inconsistent SSL/TLS validation and enforcement across configurations, increasing man-in-the-middle exposure.

    • CVE-2026-34480 - Gaps in enforcing TLS security controls in network appenders (Socket, Syslog, SMTP), exposing logs over insecure connections.

    • CVE-2026-34478 - Incomplete or weak certificate validation in TLS connections causing untrusted certificates to be accepted.

    • CVE-2026-34477 - TLS hostname verification may be ignored due to improper handling of `verifyHostName` configuration, enabling man-in-the-middle attacks.

  • SQL Injection in User Role Management ("delete role" function): The user role management function in Avaya Experience Portal running PostgreSQL contains a SQL injection vulnerability. An administrator or privileged user can inject arbitrary SQL statements into the database query executed during the "delete role" action.

Vulnerability Remediation

Addressed critical vulnerabilities identified through Coverity and Black Duck scans.

For changes in previous releases, see Changes in earlier releases.