Severity: High

Description: A security vulnerability in the SAS/CONNECT server exists in SAS Viya 3.3.

Potential Impact: An attacker who has knowledge of this vulnerability and network access to the SAS Viya servers can access restricted data.

Click the Hot Fix tab in this note to access the hot fix for this issue.

For information about a related issue, see the following SAS Notes:

• SAS Note 62112, "A Threaded Kernel IOM security vulnerability exists in SAS^® Viya^® 3.3"
• SAS Note 62115, "A programming run-time server security vulnerability exists in SAS^® Viya^® 3.3"

Operating System and Release Information

An update for this issue is available for SAS Viya 3.3. For instructions on how to access and apply software updates, see the Managing Your Software section of the SAS Viya 3.3 Administration document at