# CVE-2026-34480

> Cascade CMS is not affected by CVE-2026-34480, the Log4j XmlLayout invalid XML output issue, because the application doesn't use the affected Log4j implementation.

URL: https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/security-advisories/cve-2026-34480.html
category: Cascade Administration
article-type: reference
content-kind: faq
release-availability: all
tags: security
updated: 2026-10-06

> **Not affected**
>
> Cascade CMS is not affected by CVE-2026-34480. No action is required. *Assessed 4/29/2026.*

## What is CVE-2026-34480?

In summary:

> Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use:
>
> - JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
> - Alternative StAX implementations (e.g., [Woodstox](https://github.com/FasterXML/woodstox), a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
>
> Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
>
> [National Vulnerability Database (CVE-2026-34480)](https://nvd.nist.gov/vuln/detail/CVE-2026-34480)

## Is Cascade CMS affected by CVE-2026-34480?

After review, it has been determined that Cascade CMS is not affected by CVE-2026-34480, as the attack vector relies on an implementation of Log4j that is not utilized in the application.