Log4j 1.2.17 is not actively used or called by the SQL Server or by the BVMS. This means that the vulnerabilities are not exploitable unless you install some additional components that refer to the vulnerable component. Therefore, there is no risk of exploitation within the SQL Server or BVMS environment.
View full article