The DocuSign CLM and CLM.CM May 22.4 Product Release will be deployed to the UAT environment on Thursday, April 28, 2022 between 8:00 PM and 11:00 PM, US Central Time. We do not anticipate any impact to platform availability or access during this time.

Announcements for this upcoming release can be found on the DocuSign Support Center. Please continue to check the Support Center for enhancements and fixes that will be posted before UAT deployment. 

Please contact Technical Support if you have any questions.

The DocuSign CLM and CLM.CM April 22.3 Product Release will be deployed to the UAT environment on Thursday, March 17, 2022, between 8:00 PM and 11:00 PM, US Central Time. We do not anticipate any impact to platform availability or access during this time.

Announcements for this upcoming release can be found on the DocuSign Support Center. Please continue to check the Support Center for enhancements and fixes that will be posted before UAT deployment. 

Please contact Technical Support if you have any questions.

Please see the DocuSign Trust Center page at https://www.docusign.com/trust/compliance/public-certificates for further details on the new DocuSign SSO Certificate DEMO and PROD offer and force schedule dates.

Please see the DocuSign Trust Center page at https://www.docusign.com/trust/compliance/public-certificates for further details on the new DocuSign SSO Certificate DEMO and PROD offer and force schedule dates.

DocuSign has been actively working on assessing risk and treating affected assets since the Log4j vulnerabilities were initially disclosed on the morning of December 9.

As of January 31, DocuSign continues to observe no indicators of compromise in our environment from Log4j. DocuSign has previously deployed and continues to enhance countermeasures consistent with published CISA guidance to provide layers of protection and increased situational awareness through regular monitoring and blocking of suspicious activity. 

DocuSign has completed a 3rd party supply chain risk assessment with its critical suppliers to confirm that they have mitigations in place and are updating their software or services to remediate this issue. As new information surfaces, we will require suppliers to implement additional remediation actions as appropriate. 

As of January 31, DocuSign can confirm that the following services have been addressed and are not vulnerable to the initial Log4j2 vulnerabilities (CVE-2021-44228 and CVE-2021-45046).  Two additional vulnerabilities (CVE-2021-45105 and CVE-2021-44832), both medium severity, are being addressed through normal patching cycles.  

Product status can change as more information becomes available.

DocuSign would like to re-emphasize the severity of the Log4j vulnerabilities, whereby the remote code execution zero days (CVE-2021-44228 and CVE-2021-45046) allow malicious actors to craft a payload that can trigger the execution of arbitrary code on application servers. DocuSign is responding accordingly and DocuSign teams have active plans to remediate CVE-2021-4104,  CVE-2021-45105 and CVE-2021-44832 in alignment with established internal processes. We will continue to monitor threat intelligence for further prioritization as information becomes available. The Log4j library is used extensively in Java-based solutions industry-wide and is not limited to DocuSign services.

Please note, information shared in Trust alerts are intended for a general audience only.  Additional information may be provided to customers regarding their affected DocuSign Service configurations beyond Trust alerts, including through Support notices.   

We encourage you to perform an assessment of your specific endpoint implementations for use of the Log4j service, including third-party services. This CISA article provides more detail into the issue. Please visit https://docusign.com/trust/alerts for the latest updates regarding this alert.