This procedure was tested on a BusinessConnect 7.4.0 installation with hotfix 3 installed.

There are four files that need to be updated in the BC directories.  Here are the external links to them:

Maven Repository: org.apache.logging.log4j » log4j-api » 2.25.4

Maven Repository: org.apache.logging.log4j » log4j-core » 2.25.4

Maven Repository: org.apache.logging.log4j » log4j-slf4j-impl » 2.25.4

Maven Repository: org.slf4j » slf4j-api » 2.0.17

Download the jar files from each of these links and use the resolution below.

all platforms

1.  Shut down the BC engines. 

2.  Back up and remove the existing log4j-api-2.17.1.jar, log4j-core-2.17.1.jar, log4j-slf4j-impl-2.17.1.jar, and  slf4j-api-1.7.31.jar files $BC_HOME/lib/common directory on all servers with the BC engine on them.

3.  Install the  log4j-api-2.25.4.jar, log4j-core-2.25.4.jar,  log4j-slf4j-impl-2.25.4.jar, and slf4j-api-2.0.17.jar files into the $BC_HOME/lib/common directory on those same servers.

4.  Restart the BC engines

Two recent critical CVE's have been reported against the version of Log4j2 that is incorporated in BusinessConnect 7.4.0.  They are:

CVE-2026-34478
CVE-2026-34480

BusinessConnect 7.4.0 does not use the functionality tied to these vulnerabilities.  However, should customer opt to mitigate this vulnerability,  this article describes how to mitigate it. 

The latest hotfix to BusinessConnect 7.5.0 mitigates this vulnerability by providing updates to the necessary jar files.