Third-Party Package Updates in Splunk AppDynamics Database Agent - March 2026
Advisory ID: SVD-2026-0312
CVE ID: Multiple
Published: 2026-03-11
Last Update: 2026-03-11
Description
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk AppDynamics Database Agent version 26.1.0, and higher, including the following:
| Package | Remediation | CVE | Severity |
|---|---|---|---|
| openjdk1 | Upgraded | Multiple | High |
| mssql-jdbc | Upgraded to version 10.2.4.jre11 | CVE-2025-59250 | High |
| netty | Upgraded to version 4.1.129 | CVE-2025-67735 | Medium |
| apache-log4j | Upgraded to version 2.25.3 | CVE-2025-68161 | Medium |
| msal4j2 | Upgraded | Multiple | High |
| commons-logging3 | Upgraded | Multiple | Critical |
| oauth2-oidc-sdk4 | Upgraded | Multiple | High |
1 Upgraded openjdk from version 17.0.16 to version 17.0.18 to remedy CVE-2025-50059, CVE-2025-50106, CVE-2025-30749, CVE-2025-53066, CVE-2025-53057, and CVE-2025-30754.
2 Upgraded msal4j from version 1.10.1 to version 1.23.1, which removed the transitive dependency jackson-databind to remedy CVE-2022-42003, CVE-2022-42004, CVE-2021-46877, and CVE-2020-36518.
3 Upgraded commons-logging from version 1.2 to version 1.3.5, which updated the transitive dependency log4j to the fixed version 2.24.3 to remedy CVE-2022-23307, CVE-2019-17571, CVE-2023-26464, CVE-2022-23305, and CVE-2022-23302.
4 Upgraded oauth2-oidc-sdk from version 9.20 to 11.30.1, which updated the transitive Bouncy Castle dependencies to version 1.83 to remediate CVE-2025-8916, CVE-2024-30171, CVE-2024-29857, CVE-2023-33201, and CVE-2023-33202, and updated the transitive nimbus-jose-jwt dependencies to version 10.8 to remediate CVE-2023-52428 and CVE-2025-53864.
Solution
Upgrade Splunk AppDynamics Database Agent to versions 26.1.0 or higher.
Product Status
| Product | Base Version | Affected Version | Fix Version |
|---|---|---|---|
| Splunk AppDynamics Database Agent | 26.1 | Below 26.1.0 | 26.1.0 |
Severity
For the CVEs in this list, Splunk adopted the vendor’s severity rating or the National Vulnerability Database (NVD) common vulnerability scoring system (CVSS) rating, as available.