what are the risk for running IBM BPM 8.5.7

Question

Hi Team,

kindly please advise what are the risks associated if we are  running IBM BPM 8.5.7

Thanks & Regards

Sanjay KD

Answer 1

IBM BPM 8.5.7 reached end of support on 30 April 2021 (extended support could be bought until 2024). Running it today carries these risks:

• No security fixes: BPM 8.5.7 embeds WebSphere 8.5.5 and Java 8 builds that stopped receiving interim fixes; vulnerabilities published since (Log4j, Dojo, Jackson, WebSphere CVEs) are only fixed in BAW.
• No support case: IBM will ask you to reproduce on a supported release before working a PMR.
• Browser breakage: heritage coaches and the 8.5.7 Process Portal depend on Dojo 1.x behaviours that modern browsers keep tightening (SameSite cookies, mixed content, removal of synchronous XHR in unload). Process Designer (desktop) needs a 32-bit Java that no longer ships.
• Platform drift: databases (Db2 11.x, Oracle 19c/21c), operating systems and LDAP servers you can still install are outside the 8.5.7 support matrix; certificate changes (TLS 1.3 only, SHA-2 chains) need WebSphere fix packs that do not exist for the bundled level.
• Compliance: audits treat unsupported middleware as a finding; cyber insurance questionnaires ask for it.
• Skills and tooling: the desktop Process Designer, Integration Designer 8.5.7 and the Eclipse level they need are hard to keep running on current workstations.

Way out: BPM 8.5.7 upgrades in place to BAW 20.0.0.x / 22.0.x (BPM 8.5.7 → BAW is a supported migration path; the 8.6.0 step is not required) and from there to BAW 24.0.x, or to Workflow in Cloud Pak for Business Automation on containers. Process apps import unchanged; heritage coaches keep working but should be converted to client-side human services over time.

References

• IBM product lifecycle - IBM Business Process Manager
• BAW documentation - migrating and upgrading
• IBM Support (security bulletins)