This is a notification for product news or an alert. If you have a question, please start a new discussion

The Sage 100 Contractor Development Team has investigated the Apache Log4j vulnerability

Sage was alerted (Friday 10th December 2021) to a critical remote code execution vulnerability within all Apache log4j versions 2.0-beta9 to 2.15


A vulnerability rated with a Critical impact is one which could potentially be exploited by a remote attacker to get Log4j to execute arbitrary code (either as the user the server is running as, or root). These are the sorts of vulnerabilities that could be exploited automatically by worms.

The Sage 100 Contractor Development Team has investigated this, and the Apache Log4J 2 library is NOT used in any versions of Sage 100 Contractor.

For customers using Sage 100 Contractor with Sage Service Operations or Sage Paperless, we have confirmed that these products are not affected by this vulnerability.

Aatrix, which we use for payroll e-filing, has published this statement that they are also not impacted (

It is important to note that while Sage has confirmed as many of our integrated applications and services as possible, applications and services provided by independent software vendors may still have vulnerabilities. Customers should work with their reseller to ensure that their systems are secure.