Severity: High

Description: A security vulnerability in the Threaded Kernel IOM package exists in SAS Viya 3.3.

Potential Impact: An attacker who has knowledge of this vulnerability and network access to the SAS Viya servers can access restricted data.

Click the Hot Fix tab in this note to access the hot fix for this issue.

For information about a related issue, see the following SAS Notes:

• SAS Note 62184, "A SAS/CONNECT^® server security vulnerability exists in SAS^® Viya^® 3.3"
• SAS Note 62115, "A programming run-time server security vulnerability exists in SAS^® Viya^® 3.3"

Note: This issue is fixed in version 9.4_M5 of Threaded Kernel IOM. To find your version number of Threaded Kernel IOM, view the deployment registry as documented in SAS KB0036131.

Operating System and Release Information

An update for this issue is available for SAS Viya 3.3. For instructions on how to access and apply software updates, see the Managing Your Software section of the SAS Viya 3.3 Administration document at