TABLE OF CONTENTS

• Overview
• Executive Summary
  • Total Security Issues Resolved
  • Primary Vulnerability Classes Addressed
  • Customer Impact
  • Customer Action Required
• Information Disclosure and Configuration Hardening
  • FED-842 — Low
  • FED-843 — Low
• Dependency and Third-Party Libraries
  • FED-859 — High
• Common Weakness Enumerations and Compliance Mapping
• Support

Overview

This release addresses three security issues identified through automated security scans and software composition analysis (SCA). The fixes improve protection against information disclosure, security misconfiguration, and vulnerable third-party dependencies within FedConnect. These updates reduce exposure to information disclosure, remove unnecessary server fingerprinting, and eliminate vulnerable third-party software components to improve the application's overall security posture.

Important

For security purposes, we are not able to disclose the specific nature of the security vulnerabilities. If you have specific questions about any tickets, please reach out via support@unisonglobal.com and reference the ticket in question.

Executive Summary

The following summary provides an overview of the security issues addressed in this release and their overall impact.

Total Security Issues Resolved

A total of 3 security issues were resolved in this release:

• High severity: 1 
• Low severity: 2 

Primary Vulnerability Classes Addressed

The following vulnerability classes were addressed as part of this release:

• Exposure of Sensitive Information 
• Security Misconfiguration 
• Third-Party Dependency Risk 

Customer Impact

These updates focus on security hardening and do not introduce functional regressions.

Customer Action Required

No customer action is required.

Information Disclosure and Configuration Hardening

This section lists the security fixes for information disclosure and security configuration.

FED-842 — Low

Issue: Security scans identified unnecessary information being exposed in page responses through ViewState, increasing the potential for sensitive application metadata to be disclosed.

Remediation: Disabled ViewState where it was not required and enforced ViewState encryption on pages that required it, reducing unnecessary exposure of application data.

FED-843 — Low

Issue: The application exposed server implementation details through HTTP response headers, allowing unnecessary disclosure of infrastructure information.

Remediation: Updated the web configuration to suppress server identification headers and applied hardened IIS response header settings to reduce information disclosure.

Dependency and Third-Party Libraries

This section lists the security fixes for vulnerable third-party software components.

FED-859 — High

Issue: A high-severity software composition analysis (SCA) finding identified a vulnerable version of Microsoft.Bcl.Memory.dll and related runtime libraries affected by a published security vulnerability (CVE-2026-26127).

Remediation: Upgraded the affected Microsoft runtime libraries to secure supported versions, updated binding redirects, and validated compatibility across FedConnect services and supporting components.

Common Weakness Enumerations and Compliance Mapping

The following Common Weakness Enumerations (CWEs) and compliance-relevant categories were addressed in this release.

Support

For questions regarding this release or security findings, contact Unison FedConnect Technical Support or your Security Account Manager.