Patch 2026.1.4 / CVEs

Several vulnerabilities have been disclosed affecting the Tomcat Web Application Server:

• CVE-2026-65183
• CVE-2026-65905
• CVE-2026-65927
• CVE-2026-66422
• CVE-2026-68763
• CVE-2026-68525
• CVE-2026-68569
• CVE-2026-65182
• CVE-2026-65637

A version of Tomcat Web Application Server is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2026.1.4 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

CVE Spring Framework

A vulnerability CVE-2026-59313 has been disclosed, affecting the Spring Framework. The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.

Based on our analysis and existing automated tests of authorization procedures, we do not believe Data Management Center to be impacted by the vulnerability.

Nonetheless, we are now releasing an updated version 2026.1.4 of Data Management Center that includes a patched version of the Spring Framework.

(since 2026.1.3)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:88c57d5db23c8878c74677ce011f1564eb00c5eed7213afb861d07c345bd8b26

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2026.1.4/dmc.war (sha256: 0b8413b7c8708cc27267adb7d3aeca41e8e58c8573f02b0fa0ac8808c6583b10)