Currently, the commons-beanutils lib is a transitive dependency when using the sb2 BOM for Fuse. Older versions of commons-beanutils have CVEs, so customers are currently required to override the version in their pom to mitigate the CVEs.