CVE-2026-31431 will there be a fix available in the 8.8 release train as well? As far as I understood that track is still supported as well, hence why we haven't planned the major version upgrade yet and weren't planning to do so in the coming months

KennyDeMan (Customer) asked a question.

June 25, 2026 at 9:50 AM

CVE-2026-31431
will there be a fix available in the 8.8 release train as well?
As far as I understood that track is still supported as well, hence why we haven't planned the major version upgrade yet and weren't planning to do so in the coming months

RSA SecurID Advisories

Top Rated Answers

EricaChalfin (RSA)
a day ago
@KennyDeMan (Customer) ,

Were you able to review RSA-2026-07: RSA Authentication Manager Security Update for Third-Party Component Vulnerabilities? It mentions that RSA released the Authentication Manager 8.9 Patch 2 server and for the web tier update to address CVE-2026-31431 (Copy Fail) that affects appliances based on SLES 15.
Expand Post
Selected as Best

All Answers

EricaChalfin (RSA)
a day ago
@KennyDeMan (Customer) ,

Were you able to review RSA-2026-07: RSA Authentication Manager Security Update for Third-Party Component Vulnerabilities? It mentions that RSA released the Authentication Manager 8.9 Patch 2 server and for the web tier update to address CVE-2026-31431 (Copy Fail) that affects appliances based on SLES 15.
Expand Post
Selected as Best
KennyDeMan (Customer)
a day ago
@EricaChalfin (RSA)
Yes I did, hence why I'm asking the question if a fix in release train 8.8 will be released as well?
As far as I know 8.8 is also based on SLES 15 SP4, correct? RSA Announces the Release of RSA Authentication Manager 8.8 | RSA Community
If the answer is 'no, there will not be a patch in 8.8' this means the support track for 8.8 will be cut short? Product Version Life Cycle for RSA ID Plus and RSA SecurID | RSA Community

Expand Post
- EricaChalfin (RSA)
  Edited 18h ago
  @KennyDeMan (Customer) ,
  
  Thank you for the follow up question.
  
  Although Authentication Manager 8.8 is still a supported version, the fix for CVE-2026--31431 that was introduced in Authentication Manager 8.9 patch2, will not be added to Authentication Manager 8.8, even though both versions run on the same underlying OS.
  
  To address CVE-2026-31431, the recommended approach is to upgrade to the current supported release, which includes the fix.
  
  ETA: I missed answering your second question. Not including the fix for this CVE-2026-31431 does not mean the support lifecycle for Authentication Manager 8.8 is changing or being cut short. It remains a supported release with an end of life schedule of April 2028 (April 2029 with extended support). It just means the fix for this CVE won't be added to Authentication Manager 8.8. If you need the that is in Authentication Manager 8.9 patch 2, the recommended path is to upgrade to the current supported release.
  Expand Post

Salesforce MFA Enforcement – Action Required

Related Questions

Salesforce MFA Enforcement – Action Required

Related Questions

Trending Articles