diff --git a/application/src/main/java/org/thingsboard/server/controller/AlarmCommentController.java b/application/src/main/java/org/thingsboard/server/controller/AlarmCommentController.java
index ae8305c070..8a113fb424 100644
--- a/application/src/main/java/org/thingsboard/server/controller/AlarmCommentController.java
+++ b/application/src/main/java/org/thingsboard/server/controller/AlarmCommentController.java
@@ -30,6 +30,7 @@ import org.springframework.web.bind.annotation.RestController;
 import org.thingsboard.server.common.data.alarm.Alarm;
 import org.thingsboard.server.common.data.alarm.AlarmComment;
 import org.thingsboard.server.common.data.alarm.AlarmCommentInfo;
+import org.thingsboard.server.common.data.alarm.AlarmCommentType;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.id.AlarmCommentId;
 import org.thingsboard.server.common.data.id.AlarmId;
@@ -77,6 +78,7 @@ public class AlarmCommentController extends BaseController {
         AlarmId alarmId = new AlarmId(toUUID(strAlarmId));
         Alarm alarm = checkAlarmInfoId(alarmId, Operation.WRITE);
         alarmComment.setAlarmId(alarmId);
+        alarmComment.setType(AlarmCommentType.OTHER);
         return tbAlarmCommentService.saveAlarmComment(alarm, alarmComment, getCurrentUser());
     }
 
diff --git a/application/src/test/java/org/thingsboard/server/controller/AlarmCommentControllerTest.java b/application/src/test/java/org/thingsboard/server/controller/AlarmCommentControllerTest.java
index 17a30cac35..3bb5fd5647 100644
--- a/application/src/test/java/org/thingsboard/server/controller/AlarmCommentControllerTest.java
+++ b/application/src/test/java/org/thingsboard/server/controller/AlarmCommentControllerTest.java
@@ -44,7 +44,9 @@ import org.thingsboard.server.dao.service.DaoSqlTest;
 
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Optional;
 
+import static org.assertj.core.api.Assertions.assertThat;
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.equalTo;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
@@ -226,6 +228,18 @@ public class AlarmCommentControllerTest extends AbstractControllerTest {
         doDelete("/api/alarm/" + alarm.getId() + "/comment/" + alarmComment.getId())
                 .andExpect(status().isOk());
 
+        Optional<AlarmCommentInfo> systemCommentOpt = doGetTyped(
+                "/api/alarm/" + alarm.getId() + "/comment" + "?page=0&pageSize=10", new TypeReference<PageData<AlarmCommentInfo>>() {
+                }
+        ).getData().stream().filter(alarmCommentInfo -> alarmCommentInfo.getType().equals(AlarmCommentType.SYSTEM)).findFirst();
+        assertThat(systemCommentOpt).isPresent();
+        AlarmCommentInfo systemComment = systemCommentOpt.get();
+
+        assertThat(systemComment.getId()).isEqualTo(alarmComment.getId());
+        assertThat(systemComment.getType()).isEqualTo(AlarmCommentType.SYSTEM);
+        assertThat(systemComment.getComment().get("text").asText()).isEqualTo(String.format("User %s deleted his comment",
+                TENANT_ADMIN_EMAIL));
+
         AlarmComment expectedAlarmComment = AlarmComment.builder()
                 .alarmId(alarm.getId())
                 .type(AlarmCommentType.SYSTEM)
@@ -361,6 +375,39 @@ public class AlarmCommentControllerTest extends AbstractControllerTest {
         Assert.assertTrue("Created alarm doesn't match the found one!", equals);
     }
 
+    @Test
+    public void testShouldNotCreateOrUpdateSystemAlarmComment() throws Exception {
+        loginTenantAdmin();
+
+        AlarmComment alarmComment = AlarmComment.builder()
+                .type(AlarmCommentType.SYSTEM)
+                .comment(JacksonUtil.newObjectNode().set("text", new TextNode("Acknowledged by tenant admin")))
+                .build();
+        AlarmComment created = doPost("/api/alarm/" + alarm.getId() + "/comment", alarmComment, AlarmComment.class);
+        assertThat(created.getType()).isEqualTo(AlarmCommentType.OTHER);
+
+        // acknowledge alarm to create system comment
+        doPost("/api/alarm/" + alarm.getId() + "/ack").andExpect(status().isOk());
+
+        Optional<AlarmCommentInfo> systemCommentOpt = doGetTyped(
+                "/api/alarm/" + alarm.getId() + "/comment" + "?page=0&pageSize=10", new TypeReference<PageData<AlarmCommentInfo>>() {
+                }
+        ).getData().stream().filter(alarmCommentInfo -> alarmCommentInfo.getType().equals(AlarmCommentType.SYSTEM)).findFirst();
+        assertThat(systemCommentOpt).isPresent();
+        AlarmCommentInfo systemComment = systemCommentOpt.get();
+
+        // system comment can't be updated with other type
+        systemComment.setType(AlarmCommentType.OTHER);
+        doPost("/api/alarm/" + alarm.getId() + "/comment", systemComment).andExpect(status().isBadRequest())
+                .andExpect(statusReason(containsString("System alarm comment can't be updated!")));
+
+        // system comment can't be updated with other text
+        systemComment.setType(AlarmCommentType.SYSTEM);
+        systemComment.setComment(JacksonUtil.newObjectNode().set("text", new TextNode("New system comment")));
+        doPost("/api/alarm/" + alarm.getId() + "/comment", systemComment).andExpect(status().isBadRequest())
+                .andExpect(statusReason(containsString("System alarm comment can't be updated!")));
+    }
+
     private AlarmComment createAlarmComment(AlarmId alarmId, String text) {
         AlarmComment alarmComment = AlarmComment.builder()
                 .comment(JacksonUtil.newObjectNode().set("text", new TextNode(text)))
diff --git a/dao/src/main/java/org/thingsboard/server/dao/alarm/BaseAlarmCommentService.java b/dao/src/main/java/org/thingsboard/server/dao/alarm/BaseAlarmCommentService.java
index 505a319baa..1dec2bbe04 100644
--- a/dao/src/main/java/org/thingsboard/server/dao/alarm/BaseAlarmCommentService.java
+++ b/dao/src/main/java/org/thingsboard/server/dao/alarm/BaseAlarmCommentService.java
@@ -48,13 +48,13 @@ public class BaseAlarmCommentService extends AbstractEntityService implements Al
 
     @Override
     public AlarmComment createOrUpdateAlarmComment(TenantId tenantId, AlarmComment alarmComment) {
-        alarmCommentDataValidator.validate(alarmComment, c -> tenantId);
+        AlarmComment oldAlarmComment = alarmCommentDataValidator.validate(alarmComment, c -> tenantId);
         boolean isCreated = alarmComment.getId() == null;
         AlarmComment result;
         if (isCreated) {
             result = createAlarmComment(tenantId, alarmComment);
         } else {
-            result = updateAlarmComment(tenantId, alarmComment);
+            result = updateAlarmComment(tenantId, alarmComment, oldAlarmComment);
         }
         if (result != null) {
             eventPublisher.publishEvent(SaveEntityEvent.builder().tenantId(tenantId).entity(result)
@@ -101,18 +101,17 @@ public class BaseAlarmCommentService extends AbstractEntityService implements Al
         return alarmCommentDao.save(tenantId, alarmComment);
     }
 
-    private AlarmComment updateAlarmComment(TenantId tenantId, AlarmComment newAlarmComment) {
+    private AlarmComment updateAlarmComment(TenantId tenantId, AlarmComment newAlarmComment, AlarmComment oldAlarmComment) {
         log.debug("Update Alarm comment : {}", newAlarmComment);
 
-        AlarmComment existing = alarmCommentDao.findAlarmCommentById(tenantId, newAlarmComment.getId().getId());
-        if (existing != null) {
+        if (oldAlarmComment != null) {
             if (newAlarmComment.getComment() != null) {
                 JsonNode comment = newAlarmComment.getComment();
                 ((ObjectNode) comment).put("edited", "true");
                 ((ObjectNode) comment).put("editedOn", System.currentTimeMillis());
-                existing.setComment(comment);
+                oldAlarmComment.setComment(comment);
             }
-            return alarmCommentDao.save(tenantId, existing);
+            return alarmCommentDao.save(tenantId, oldAlarmComment);
         }
         return null;
     }
diff --git a/dao/src/main/java/org/thingsboard/server/dao/service/validator/AlarmCommentDataValidator.java b/dao/src/main/java/org/thingsboard/server/dao/service/validator/AlarmCommentDataValidator.java
index ea2060a6a4..b70251027d 100644
--- a/dao/src/main/java/org/thingsboard/server/dao/service/validator/AlarmCommentDataValidator.java
+++ b/dao/src/main/java/org/thingsboard/server/dao/service/validator/AlarmCommentDataValidator.java
@@ -18,14 +18,18 @@ package org.thingsboard.server.dao.service.validator;
 import lombok.AllArgsConstructor;
 import org.springframework.stereotype.Component;
 import org.thingsboard.server.common.data.alarm.AlarmComment;
+import org.thingsboard.server.common.data.alarm.AlarmCommentType;
 import org.thingsboard.server.common.data.id.TenantId;
-import org.thingsboard.server.exception.DataValidationException;
+import org.thingsboard.server.dao.alarm.AlarmCommentDao;
 import org.thingsboard.server.dao.service.DataValidator;
+import org.thingsboard.server.exception.DataValidationException;
 
 @Component
 @AllArgsConstructor
 public class AlarmCommentDataValidator extends DataValidator<AlarmComment> {
 
+    private final AlarmCommentDao alarmCommentDao;
+
     @Override
     protected void validateDataImpl(TenantId tenantId, AlarmComment alarmComment) {
         if (alarmComment.getComment() == null) {
@@ -35,4 +39,20 @@ public class AlarmCommentDataValidator extends DataValidator<AlarmComment> {
             throw new DataValidationException("Alarm id should be specified!");
         }
     }
+
+    @Override
+    protected AlarmComment validateUpdate(TenantId tenantId, AlarmComment alarmComment) {
+        AlarmComment oldAlarmComment = null;
+        if (alarmComment.getId() != null) {
+            oldAlarmComment = alarmCommentDao.findAlarmCommentById(tenantId, alarmComment.getId().getId());
+            if (oldAlarmComment == null) {
+                throw new DataValidationException("Can't update non existing alarm comment!");
+            }
+            if (oldAlarmComment.getType() == AlarmCommentType.SYSTEM) {
+                throw new DataValidationException("System alarm comment can't be updated!");
+            }
+        }
+        return oldAlarmComment;
+    }
+
 }
diff --git a/pom.xml b/pom.xml
index 6b4c1ec088..ca31fc9637 100755
--- a/pom.xml
+++ b/pom.xml
@@ -70,6 +70,7 @@
         <metrics.version>4.2.25</metrics.version>
         <cassandra-all.version>5.0.4</cassandra-all.version> <!-- tools -->
         <guava.version>33.1.0-jre</guava.version>
+        <tomcat.version>10.1.54</tomcat.version> <!-- to fix CVE-2026-34487, CVE-2026-34486, CVE-2026-34483. TODO: remove when fixed in spring-boot-dependencies -->
         <commons-lang3.version>3.18.0</commons-lang3.version> <!-- to fix CVE-2025-48924. TODO: remove when fixed in spring-boot-dependencies -->
         <commons-io.version>2.16.1</commons-io.version>
         <commons-logging.version>1.3.1</commons-logging.version>
@@ -991,6 +992,25 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- Temporary tomcat version override to fix CVE-2026-34487, CVE-2026-34486, CVE-2026-34483.
+                 Must be declared before the spring-boot-dependencies BOM import to take precedence.
+                 TODO: remove when fixed in spring-boot-dependencies -->
+            <dependency>
+                <groupId>org.apache.tomcat.embed</groupId>
+                <artifactId>tomcat-embed-core</artifactId>
+                <version>${tomcat.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.tomcat.embed</groupId>
+                <artifactId>tomcat-embed-el</artifactId>
+                <version>${tomcat.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.tomcat.embed</groupId>
+                <artifactId>tomcat-embed-websocket</artifactId>
+                <version>${tomcat.version}</version>
+            </dependency>
+            <!-- End of tomcat version override -->
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>
diff --git a/ui-ngx/src/app/modules/home/components/alarm/alarm-assignee-panel.component.html b/ui-ngx/src/app/modules/home/components/alarm/alarm-assignee-panel.component.html
index c0f983e6d0..fbbce2a469 100644
--- a/ui-ngx/src/app/modules/home/components/alarm/alarm-assignee-panel.component.html
+++ b/ui-ngx/src/app/modules/home/components/alarm/alarm-assignee-panel.component.html
@@ -42,7 +42,7 @@
       <div class="user-display-name flex flex-col gap-0.5">
         <span *ngIf="user.firstName || user.lastName"
               [innerHTML]="getFullName(user) | highlight:searchText"></span>
-        <span [innerHTML]="user.email | highlight:searchText"></span>
+        <span [innerHTML]="user.email | highlight:searchText" tbTruncateWithTooltip></span>
       </div>
     </mat-option>
     <mat-option *ngIf="!(filteredUsers | async)?.length" [value]="null" class="tb-not-found">