diff --git a/kogito-build/kogito-dependencies-bom/pom.xml b/kogito-build/kogito-dependencies-bom/pom.xml
index 65670e489bd..d989deb5f9d 100644
--- a/kogito-build/kogito-dependencies-bom/pom.xml
+++ b/kogito-build/kogito-dependencies-bom/pom.xml
@@ -155,6 +155,7 @@
     <version.com.google.collections>1.0</version.com.google.collections>
     <version.com.google.guava>33.0.0-jre</version.com.google.guava>
     <version.apache.commons.commons-compress>1.26.1</version.apache.commons.commons-compress>
+    <version.com.thoughtworks.xstream>1.4.21</version.com.thoughtworks.xstream>
   </properties>
 
   <dependencyManagement>
@@ -451,13 +452,13 @@
         <version>${version.jakarta.persistence-api}</version>
       </dependency>
 
-
       <!-- Temporary excluding xstream, current Quarkus version is importing a version (1.4.20) affected by CVE
            When upgrading Quarkus (> 3.15.x) to a new version, please evaluate if this exclusion can be removed   -->
       <dependency>
         <groupId>com.thoughtworks.xstream</groupId>
         <artifactId>xstream</artifactId>
-        <version>1.4.21</version>
+        <scope>test</scope>
+        <version>${version.com.thoughtworks.xstream}</version>
       </dependency>
 
       <dependency>