PBI OnPrem Gateway: Need to update the jar log4j-core-2.25.3 to 2.25.4 (May 2026)

The on-premises data gateway and its bundled components, including Log4j, are serviced only through the official monthly gateway releases. The supported and recommended way to address dependency versions or vulnerabilities is to:

1. Ensure the gateway is on a currently supported build (one of the last six monthly releases).
2. Apply newer gateway releases as they become available.

From the provided information:

• The May 2026 gateway (version 3000.318) is a supported release.
• Gateway troubleshooting and security guidance explicitly recommend staying on a supported, up-to-date gateway build and updating when new versions are released.

Within this context, the following points can be addressed:

• Upgrade Procedure: There is no documented or supported procedure to selectively upgrade or replace individual third-party JARs (such as log4j-core) inside the on-premises data gateway installation. The supported update path is to upgrade the entire gateway to a newer monthly build using either:
  • The Fabric/Power BI portal UI (Manage Gateways → On-premises data gateways → select gateway → Update), or
  • The Update-DataGatewayClusterMember PowerShell command for programmatic/at-scale updates.
• Manual Replacement: The documentation does not describe or support manual replacement of internal gateway binaries or libraries. Only full gateway updates are covered. Because manual modification of gateway binaries is not documented as supported, it falls outside the supported configuration model. The only supported way to change bundled components is via an official gateway update.
• Version Implications (2.25.3 vs 2.25.4): The available content does not provide any comparison or operational, performance, or compatibility notes specific to Log4j 2.25.3 versus 2.25.4 in the gateway. It only states, in the context of Azure SDK for Java, that Log4j 2.16 or later should be used due to CVE-2021-44228. No additional guidance is given about later micro-version differences within the gateway.
• Product Roadmap / Future Inclusion of 2.25.4+: The context shows that:
  • A new on-premises data gateway build is released monthly.
  • Only the last six releases are supported.
  However, there is no specific roadmap information or commitment about when a particular Log4j micro-version (such as 2.25.4) will be included in a gateway build.

Given the above, the supported approach to meet internal security requirements is:

1. Keep the gateway on a supported, current monthly build (for example, May 2026 or later as new versions are released).
2. Plan to adopt newer gateway releases promptly as they become available, since dependency updates (including Log4j) are delivered only through those official builds.
3. Avoid manual modification of gateway installation files, including JARs, because such changes are not covered by the documented update and support model.

For vulnerability management and detection of Log4j-related issues across the environment, Defender Vulnerability Management can be used to discover vulnerable Log4j-core files and Uber-JARs, but remediation for the gateway itself must be via official gateway updates.

References:

• Currently supported monthly updates to the on-premises data gateways
• Update an on-premises data gateway
• Troubleshoot the on-premises data gateway
• Troubleshoot Power BI gateway (personal mode)
• Guidance for deploying a data gateway for the Power BI service
• Log with the Azure SDK for Java and Log4j
• Learn how to manage the Log4Shell vulnerability in Microsoft Defender for Endpoint