title
SAS Product Security
subhead
Latest bulletins and updates
background-color
#024F87
text-alignment
center
Title
Security Bulletins

Security Bulletins

placeholder
Search SAS Support
submit-label
Search
no-keyword-title
No keyword
no-keyword-message
Please enter a search term
no-results-title
No results found
no-results-message
Please enter a new search term
source
/en/data/security-bulletins-index.json
fields
  • Title (title, path)
  • Date (releasedate)
  • Severity (severity)
  • Description (description)
page-size
10
search-label
Filter bulletins
empty-label
No bulletins match your filter.
header-background
#024F87
filter
  • path ^= ./

RSS Feed of Security Bulletins

Severity
CVSS Range
Informational
0.0
Low
0.1 - 3.9
Medium
4.0 - 6.9
High
7.0 - 8.9
Critical
9.0 - 10.0

Note: Hot fixes for each product component are cumulative and might include functionality fixes in addition to security fixes. For a list of hot fixes that are available for your products, use the the SAS Hot Fix Analysis, Download & Deployment (SASHFADD) tool.  See the Hot Fix FAQ for a general overview of hot fixes.

Note: To ensure that SAS customers have the latest security updates for SAS software, SAS recommends that customers install the most current release of the software, including maintenance and security hot fixes.

Title
JRE Updates

Java 21, 11, 8, and 7 Updates

SAS provides a version of the required Java Runtime Environment (JRE) along with SAS 9.4 software (known as the “SAS Private JRE”). SAS partners with Azul to deliver and test Java updates that contain security fixes and improvements for an existing Java version. SAS makes these updates available from the SAS Downloads Site for SAS 9.4 releases under Standard Support on a regular basis.

SAS recommends that you update your SAS Private JRE when update packages are made available by SAS. SAS also recommends that you check for update availability regularly.

Updates to the SAS Private JRE are performed separately from the application of regular security updates and hot fixes. For more information, see Preparing the SAS Software Depot with Security Updates and Hot Fixes.

SAS delivers regular updates of the SAS Private JRE as follows:

In alignment with the SAS 9.4 Java vendor, SAS updates for Java 7 and earlier are no longer available. See the Azul Support lifecycle for existing and planned JDK releases. SAS continues to provide the last Java 7 update, which was released by SAS in August 2022. Download updates for Java 7.

See SAS Third-Party Software Requirements for details.
See also SAS Note 56203 for the updates to the Java 21, Java 11, Java 8, and Java 7 JREs and JDKs.

Title
Vulnerability Notes

Vulnerability Notes

placeholder
Search SAS Support
submit-label
Search
no-keyword-title
No keyword
no-keyword-message
Please enter a search term
no-results-title
No results found
no-results-message
Please enter a new search term
source
/en/data/vulnerability-notes.json
fields
  • Title (title, link)
  • Date (date)
  • Severity (severity)
  • Product (product)
page-size
10
search-label
Filter vulnerability notes
empty-label
No vulnerability notes match your filter.
header-background
#024F87
Title
Security Team

Product Security Incident Response Team

To keep you informed about any suspected or confirmed security issues, SAS publishes security bulletins and SAS Notes as part of our formal Product Security Incident Response Team (PSIRT) process.

Customers who have SAS support contracts should report a suspected security issue by opening a case with SAS Technical Support.  Security researchers or others who do not have a support contract can contact PSIRT directly by sending email to psirt@sas.com.

Open a Case