EY COM Security Report | Netcentric Affected Libraries

[GulshanKumar-JSR]

Hi Team,

I hope you are doing well. I wanted to reach out regarding some specific issues that were highlighted by the Adobe Team as part of the recent Security Health report. These issues have been outlined in below screenshot, and I believe it’s important for us to address them promptly to ensure our security standards remain robust.

Could you please review the points raised and share your feedback or any updates related to these concerns? Your insights and responses will help us take the necessary steps to resolve these issues efficiently. If you need any further details or clarification on the items mentioned, please let me know.

Looking forward to your response and thank you in advance for your attention to these matters.

Issue 1:

Related Links -

https://owasp.org/Top10/2025/A03_2025-Software_Supply_Chain_Failures/
https://nvd.nist.gov/vuln/detail/CVE-2025-24813
https://nvd.nist.gov/vuln/detail/CVE-2024-50379
https://nvd.nist.gov/vuln/detail/CVE-2024-52316
https://nvd.nist.gov/vuln/detail/CVE-2024-56337
https://nvd.nist.gov/vuln/detail/CVE-2025-31651

Issue 2:

Related Links -

https://owasp.org/Top10/2025/A02_2025-Security_Misconfiguration/

[kwin]

Although all those CVEs I consider false positives in the case of ACTool those have been fixed in more recent versions of the ACTool. Just upgrade to the latest version and you should be fine.

[kwin]

This is ACTool not acs-aem-commons. The latter is a different library

[GulshanKumar-JSR]

@kwin - That's my mistake, I was raising multiple requests, and I've mentioned about ACS Commons over this portal.

We are using biz.netcentric.aem-6.5.5.0 version and I think this is quite older version.

AEM (AEMasaCS) Version being used - 2026.5.26309.20260526T180029Z-260500

[kwin]

We are using biz.netcentric.aem-6.5.5.0 version and I think this is quite older version.

This is not a valid ACTool version either.

[GulshanKumar-JSR]

@kwin -
biz.netcentric.cq.tools.accesscontroltool - 3.5.1

[kwin]

That is an old version. As said before just upgrade to the newest one.