Security Vulnerability updates

Check this page for updates related to critical security vulnerabilities.

In this section:

  1. CVE-2021-44228, CVE-2021-45046, and CVE-2021-45105: Apache log4j
    CVE-2021-44228 was opened on December 10, 2021. CVE-2021-45046 and CVE-2021-45105 followed on December 14th and December 18th.
  2. CVE-2022-22963 and CVE-2022-22965: Spring Framework components
    CVE-2022-22963 & CVE-2022-22965 were opened on April 1, 2022. Initial reports indicate that CVE-2022-22963 affects Spring Cloud Function (versions 3.1.6, 3.2.2, and older versions) and CVE-2022-22965 affects Spring MVC or Spring WebFlux applications running on Java 9 and higher in WAR packages running under Tomcat.
  3. eMudhra Intermediate CA Compromise
    On October 20 2026, it was announced that private keys for eight eMudhra intermediate certificate authority (CA) certificates had been compromised. The certificates have been revoked and major browsers have already been updated to block requests that use them.
  4. CVE-2026-109618 and CVE-2026-109619: PHP
    These PHP vulnerabilities were announced in October 2026. At this time, Ricoh production printing software and websites are not subject to these vulnerabilities.
Parent topic: Software Support Documents