DocumentationExperience Cloud KCS

AEM 6.5.24: Scanner false positive for CVE-2026-49844 (Apache Log4j)

Last update: August 26, 2026

This article describes why security scanners report CVE-2026-49844 (Apache Log4j) in AEM 6.5.24 deployments and provides guidance on product impact, remediation, and audit documentation.

Description description

Environment

Adobe Experience Manager (AEM) 6.5.24 (latest available Service Pack for AEM 6.5)

Symptoms

Security vulnerability scanners report CVE-2026-49844 (Apache Log4j, Improper JSON Serialization, version 2.20.0) in AEM 6.5.24 deployments. The scanner flags Adobe-shipped OSGi bundles containing Log4j libraries, typically found in the AEM installation directory. The scanner may recommend upgrading to Log4j 2.25.5 or later.

No error is observed in AEM runtime; the issue is limited to scanner findings.

Cause

Vulnerability scanners flag the presence of Log4j API based on version detection, but the vulnerable code path for CVE-2026-49844 is present only in Log4j Core, which isn’t shipped or used in standard AEM 6.5.24 deployments. This results in a known false positive for out-of-the-box AEM 6.5.24.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Confirm Log4j Core isn’t present in standard AEM 6.5.24:

    • The flagged bundles in AEM 6.5.24 contain only org.apache.logging.log4j.api version 2.20.0 (Log4j API), not log4j-core.

    • The vulnerable code path for CVE-2026-49844 exists only in Log4j Core, not in the API library.

  2. Validate via OSGi Console:

    • Access /system/console/bundles on your AEM Author and Publish instances.

    • Search for org.apache.logging.log4j.core.

    • If not present, your environment isn’t affected by this CVE.

  3. No remediation is required for standard AEM 6.5.24:

    • Adobe doesn’t provide a hotfix or recommend manual replacement of Adobe-shipped logging libraries for this finding.

    • Continue running the latest supported AEM 6.5 service pack and follow Adobe Security Bulletins.

  4. Check for custom or third-party bundles:

    • If you have deployed custom or third-party OSGi bundles that include log4j-core, upgrade those components to Log4j Core 2.25.5 or later, as per your build pipeline.

  5. For audit purposes:

    • Document that “The Log4j API bundle alone doesn’t provide the vulnerable code paths associated with critical CVEs. Without log4j-core in the runtime, the known critical vulnerabilities aren’t exploitable in standard AEM 6.5.24.0 deployments.”

    • Reference Adobe’s official guidance and KCS articles as needed.

recommendation-more-help
experience-cloud-kcs-help-kbarticles