Release Notes
Abstract
The following table contains the complete listing of fixes for IBM Content Navigator version 26.0.0
Content
Known Issues and vulnerabilities fixed in IBM Content Navigator version 26.0.0
| Known Issues | Description |
|---|---|
| Security Vulnerability | CVE-2025-48924 in commons-lang jar used in RecycleBin plugin resolved. |
| Security Vulnerability | CVE-2025-8916 in bcprov-jdk18on-1.78.jar resolved. |
| Security Vulnerability | CVE-2025-48976 in commons-fileupload resolved. |
| Security Vulnerability | Spring packages upgraded to 5.3.51 to resolve multiple CVEs. |
| Security Vulnerability | CVE-2012-0881 in xerces-2.4.0.jar resolved. |
| Security Vulnerability | CVE-2019-13116 in commons-collections-3.1.jar resolved. |
| Security Vulnerability | CVE-2021-33813 in jdom-1.0.jar resolved. |
| Security Vulnerability | CVE-2022-34169 in xalan-2.7.2.jar resolved. |
| Security Vulnerability | CVE-2023-35116 in jackson-databind packaged resolved by upgrading to v2.16.0 |
| Security Vulnerability | CVE-2023-51775 in jose4j-0.9.4.jar resolved. |
| Security Vulnerability | CVE-2024-29371 resolved by update of Jose4J Library to 0.9.6. |
| Security Vulnerability | CVE-2025-46392 in commons-configuration-1.10.jar resolved. |
| Security Vulnerability | CVE-2025-46392 in commons-configuration-1.10.jar used in Task Manager component resolved. |
| Security Vulnerability | CVE-2025-48924 resolved in Snowbound library by upgrade from 20.18.0 to 20.19.7. |
| Security Vulnerability | CVE-2025-48924 CVE-2020-8908 CVE-2025-66453 resolved by update of Swagger Parser jars. |
| Security Vulnerability | CVE-2025-48924 in commons-lang-2.2.jar resolved. |
| Security Vulnerability | CVE-2025-48924 resolved by removing Apache Wink from TaskManager |
| Security Vulnerability | CVE-2025-53864 in SharePoint plugin resolved by upgrading nimbus-jose-jwt library to v10.0.2+. |
| Security Vulnerability | CVE-2024-57699 in Json-smart used in SharePointOnlinePlugin plugin resolved. |
| Security Vulnerability | CVE-2025-58754, CVE-2025-27152 resolved by upgrade of axios package to 1.13.5 |
| Security Vulnerability | CVE-2025-62718 in axios package resolved. |
| Security Vulnerability | CVE-2025-66453 (Rhino) in rhino.jar 1.7.14 resolved. |
| Security Vulnerability | CVE-2025-68161, CVE-2019-17571, CVE-2020-9488, CVE-2020-9493, CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307, CVE-2023-26464 resolved by update of Log4J library. |
| Security Vulnerability | CVE-2025-68161, CVE-2019-17571, CVE-2020-9488, CVE-2020-9493, CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307, CVE-2023-26464 resolved by update of Log4J library. |
| Security Vulnerability | CVE-2026-0636 resolved with including bcprov-jdk18on-1.81.jar. |
| Security Vulnerability | CVE-2026-1243 resolved. |
| Security Vulnerability | CVE-2026-22740, CVE-2026-22741, CVE-2026-22745 in Spring framework of Sync server component resolved. |
| Security Vulnerability | CVE-2026-33929 in pdfbox jar resolved |
| Security Vulnerability | CVE-2026-35554 in kafka-clients-3.9.1.jar reported for ICN and icnBaiEmitter, resolved. |
| Security Vulnerability | CVE-2026-40895 in axios 1.15 package resolved. |
| Security Vulnerability | CVE-2026-45205 addressed by updating to commons-configuration2-2.15.0.jar |
| Security Vulnerability | CVE-2024-47554 in Apache Commons IO package use in SharePointPlugin and SharePointOnlinePlugin plugins resolved. (2.14.0) |
| Security Vulnerability | CVE-2025-5878 in ESAPI jar resolved. |
| Security Vulnerability | CVE-2025-27817, CVE-2025-27818 in kafka-clients-3.8.1.jar resolved. |
| Security Vulnerability | CVE-2025-48924 in commons-lang jar resolved. |
| Security Vulnerability | CVE-2025-48734 in commons-beanutils package resolved. |
| Security Vulnerability | CVE-2026-42198 in postgresql-42.7.2.jar resolved. |
| DT389474 | (IBM Content Navigator users) dojoIOIframeSend call replaces dojo.io.iframe with dojo.request.iframe method and sends iFrame with "post" call instead of with "POST" call, causing an error. |
| DT391969 | (IBM FileNet Content Manager users) Recycle Bin feature labels are not displayed according to the locale being used. |
| DT398372 | (IBM Content Navigator users) 'Configuring your database and data source' fails for Oracle RAC with a "_driverVersion": no such variable" error. |
| DT420297 | (IBM Content Navigator users) PDFs generated by 'Download as PDF' action on .docx and .xlsx files show incorrect or misaligned data. |
| DT433803 | (IBM Content Navigator users) Password is changed incorrectly for a user who attempts to login to a desktop, immediately after log out action on the same desktop by a previously logged in user. |
| DT435913 | (IBM Content Navigator users) Long repository names are truncated in the dropdown field in Entry Template Manager before being clicked. If the dropdown is opened, the full name is visible. |
| DT437149 | (IBM Content Navigator users) When navigating in the content or results pane, JAWS screen reader does not announce the sorting order (ascending or descending) of the column headers. |
| DT437435 | (IBM Content Navigator users) Local File Inclusion (LFI) vulnerability fixed. |
| DT438275 | (IBM Content Manager users) An error, 'Your request cannot be processed' occurs when a saved search's results are refreshed, after clicking View Workflow Information action in the Workflow submenu of the context menu of a search result. |
| DT438400 | (IBM Content Navigator users) Text loss is observed in Search Results section when zooming the browser page to 200%, with screen resolution 1024 X 768. |
| DT440525 | (IBM Content Navigator users) Name column value of work item in Work feature changes to 'Error' if the work item's Class value is modified. |
| DT440526 | (IBM Content Navigator plugin users) Extra back slashes (\) are inserted into values of plugin fields that contain a path value, after opening and re-saving a plugin's configuration. |
| DT440604 | (IBM Content Navigator users) Cross-site scripting (XSS) with Daeja ViewONE viewer fixed. |
| DT443468 | (IBM Content Navigator users) Using 'Merge and Split' action, if the Layout is switched to 'Split Vertically' or 'Split Horizontally' and page(s) copied from the opened document are pasted to the new pane and 'Add Document' icon is clicked, then in the subsequent Add Document dialog, if the 'Use source document' checkbox is selected for the Classification field, duplicate values are seen in the dropdown for this field. |
| DT444584 | (IBM Content Navigator users) Using a choice list consisting of sublists that have common values, if a common value from one sublist is selected and the same value is later selected from a different sublist, then the values from the initially selected sublist are displayed, instead of the subsequently selected sublist's values. |
| DT446219 | (IBM Content Manager users) When navigating using the Tab key, pressing Enter key on the buttons that receive focus, does not result in a click event, thus violating WCAG standards. |
| DT447419 | (IBM Content Navigator users) Polish label for 'Checkout and Download' action incorrect. |
| DT449441 | (IBM Content Navigator users) Users with masked comma in the name and who are part of an LDAP group, receive an error on attempt to login to the administration desktop, if LDAP Groups is enabled in the Administrator Group Configuration section, in the General tab of the Settings section of the administration desktop. |
| DT449665 | (IBM Content Navigator Users) Hourly repeating tasks cannot be scheduled with valid end date and end time and can sometimes be scheduled with past start time. |
| DT451653 | (IBM Content Navigator users) Email action fails if the login user does not have an email configured in their profile, even though mail.from mail session property is present. |
| DT453099 | (IBM Content Navigator users) Send Email As a Link action does not work (nothing happens) when multiple documents are selected, with 'Use the desktop email client with the edit client service' option selected in the target desktop configuration. This fix requires using a compatible Edit Service Client. |
| DT454879 | (IBM Content Navigator users) DocuSign signature history shows 'Your request cannot be processed' error. |
| DT455886 | (IBM Content Navigator users) DocuSign plugin context menu action 'Send for Signature' fails for users that do not have permission to create new folders within the object store's root folder. |
| DT456899 | (IBM Content Navigator users) Users are unexpected logged out during long running searches or actions such opening large documents. |
| DT457380 | (IBM Content Navigator users) Task Manager does not capture logs for failed tasks. |
| DT457539 | (IBM Content Manager users) Ajax Viewer does not display all parts of a multi-part document. |
| DT457547 | (IBM Content Navigator users) Selecting properties for display in Browse or Search tabs of a repository configuration in the administration desktop may require a double mouse click after using a the property filter box. |
| DT457553 | (IBM Content Navigator users) Error about missing commons-codec.jar occurs when executing icn.admin.keys.rotateMasterKey() command in the Developer Tools Console tab. |
| DT457649 | (IBM Content Navigator users) Task Manager administrator password cannot be changed due to failure to encrypt the updated password. |
| DT458135 | (IBM Content Navigator users) Preview action on Microsoft Office documents fails if using HTML Conversion Viewer for Preview in the viewer map. |
| DT458340 | (IBM Content Navigator Container users) Daeja logs incorrectly report missing lic-server.v1 license file in container environment. |
| DT458997 | IBM Content Navigator Microsoft Office for the Web integration shows excessive browser CPU and memory usage. |
| DT459975 | (IBM Content Manager users) New Search fails with "class not found" error. |
| DT460290 | (IBM Content Navigator users) CVE-2025-68161 in Daeja Virtual Viewer jiserver.jar resolved by update of Daeja ViewONE jiserver.jar with Log4J 2.25.4 jars. |
| DT460704 | (IBM Content Manager OnDemand users) Selecting a search from Content Manager OnDemand results in an error 'Search cannot be loaded', in container environments. |
| DT461040 | (IBM Content Manager users) Error 'You cannot use the specified class' occurs on attempt to use existing or create new search. |
| DT464781 | (IBM Content Navigator users ) Annotation save fails after session timeout. The session not extended for the save operation. |
| DT466213 | (IBM Content Navigator users) Error about missing commons-lang3.jar occurs when executing icn.admin.keys.rotateMasterKey() command in the Developer Tools Console tab. |
| DT468999 | (IBM Content Manager OnDemand users) Add Document action fails with your 'Your request cannot be processed' error in the browser. |
| DT470278 | (IBM Content Navigator users) After LTPA authentication token expires for the IBM Content Navigator (ICN) Sync Client, the sync queue hangs and the "Sync Now" button stops working. |
[{"Type":"MASTER","Line of Business":{"code":"LOB18","label":"Miscellaneous LOB"},"Business Unit":{"code":"BU056","label":"Miscellaneous"},"Product":{"code":"SSEUEX","label":"IBM Content Navigator"},"ARM Category":[{"code":"a8m3p000000LRz9AAG","label":"IBM Content Navigator"}],"ARM Case Number":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"},{"code":"PF055","label":"zLinux"}],"Version":"26.0.0"}]
Was this topic helpful?
Document Information
Modified date:
01 August 2026
UID
ibm17281344