Marketing Communique

Download and upgrade to 26.03 today!

Security Advisory for Java

On October 21, 2026, OpenJDK and Oracle published an out-of-band advisory for CVE-2026-91403, rated CVSS 9.1, for compromised CA certificates in the Java trust store. Eight intermediate CA certificates issued by eMudhra were signed with weak private keys, and the root that signed them ("emSign ECC Root CA - G3") ships in the default Java trust store (cacerts). A network attacker holding one of those keys can issue a certificate for any hostname that a Java TLS client will accept as valid.

There is no remote code execution and no path into BBjServices. The exposure is confined to outbound TLS connections that BBj or your BBj programs make to external services using the JVM's default trust store. An attacker positioned on that network path can impersonate the remote service, read what is sent to it, and alter what comes back.

BASIS International Ltd. supports version 26.03 of BBj®, the Barista® Application Framework, and AddonSoftware® on an Oracle or a Temurin JDK that resolves the compromised CA certificates issue, with the exception of the Temurin JDKs for the AIX OS. Refer to the Readme file for specific JDK versions.

What is affected

Any outbound TLS connection that relies on the JVM default trust store. In a BBj environment that includes:

• BBj programs that call Java HTTP clients to reach external HTTPS endpoints, such as java.net.http, HttpsURLConnection, and Apache HttpClient
• BBj programs that open JDBC connections with TLS to third-party databases (PostgreSQL, MySQL, SQL Server, Oracle, and others) using the driver's default trust
• Enterprise Manager email notifications over STARTTLS or SMTPS, where the SMTP account credentials travel on the connection
• The S3 file system via the AWS SDK
• CXF web service clients
• JGit over HTTPS
• Client-side Java HTTP calls made from thin client sessions

The realistic threat is an attacker on the network path between BBjServices (or a thin client) and one of these endpoints. Traffic that crosses the public internet, cloud regions, or a SaaS boundary is the primary concern.

What is not affected

All TLS that BBj establishes between its own components is built from the BASIS-internal keystores and never consults the cacerts. A forged public-CA certificate is rejected on these links regardless of JVM version:

• Thin client to BBjServices (SSL)
• BBj JDBC driver to BBjServices (SSL)
• Remote file system (Netty)
• Secure class loading
• LDAP / LDAPS authentication
• Inbound TLS

Jetty and the SSL listeners are servers; the compromised certificates are a client-side trust problem. Browsers reaching BUI and DWC applications use their own trust stores, not the JVM's, and major browsers have already distrusted the affected intermediates.

Thin clients and field packages

The thin client JVM matters only for Java HTTP calls made on the client side. If your field deployment packages a JVM, apply the same check and update to the packaged JVM and re-cut the package.



Use one of the following methods to check the JVM in use:

• In the Java Settings section of Enterprise Manager
• INFO(1,1)
• BBjThinClient::getClientJavaVersion

AI Development Kit - AI DVK and BBj AI training class

BASIS ships two Model Context Protocol (MCP) servers for AI coding agents using BBj: the Language MCP server and the BBj MCP server.

In BBj 26.03 and higher, BBj communicates directly with the Language MCP server, allowing a coding agent to compile code, read errors, and fix them with BBj validating the syntax.

The BBj MCP server, accessible via the AI DVK, indexes BBj documentation and skill guides for agents. Knowledge of the reserved-word table (ordinary-looking names like FI, DAY, LIST and FOR that fail as variables), the verb reference, DWC theming, and layout rules are provided. The agent looks up verbs, methods, and DWC controls rather than hallucinating them.

Plugins for Anthropic Claude Code and OpenAI Codex install both. Your source never leaves your machine; only lookup queries go to the hosted server.

Access to the BBj MCP server is included with the AI Developer Kit (AI DVK) subscription, which is now available for $99 per developer per month (billed annually). The AI DVK is a superset of the regular DVK and includes a 2-user BBj license with all optional feature lines. You can reach the BBj MCP server using either Claude or Codex via the BBj plugin.

BASIS is also offering an 8-hour AI training course to get you up to speed on the latest technology. You can find more details and prerequisites in the previous communique, or register for the training right away!

SQL — FORMAT() Function 

The new SQL FORMAT() function makes it easier than ever to format numeric values, strings, dates, and timestamps directly within your SQL queries. Using the FORMAT() function simplifies displaying currency, formatting dates, converting text, and presenting large numbers in a more readable way, giving you a flexible approach to how data appears.

With support for built-in formatting presets, custom patterns, and locale-specific formatting, FORMAT() gives you greater control over your query results without requiring additional formatting logic in your applications. For example, you can format 1234.50 as $1,234.50 using FORMAT(1234.50, 'currency', 'en-US'), display 1500000 as 1.5M using the compact preset, or apply custom patterns to dates, numbers, and strings. You can even specify a locale to automatically adjust formatting conventions for different regions. Check out the documentation today to discover how to make your data presentation cleaner and more effective!

Introducing the DWC Design Kit 26 for Figma

The DWC Design Kit 26 for Figma is now available, featuring over 50 ready-to-use components and HTML elements, shared styles, and complete application examples. It offers high-fidelity representations and extensive customization options, along with documentation and guidance for quick prototyping. Additionally, the Figma MCP server can enhance AI-assisted design workflows, speeding up the transition from design to working prototypes.

The previous version of DWC Design Kit is still available separately as a legacy kit for developers using BBj older than 26.00.

Download and upgrade to 26.03 today!

BBj, BBx, AddonSoftware, and Barista are registered trademarks of BASIS International Ltd.