Apache Log4j2 Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
Also Known as Log4Shell
Log4Shell is the common name for the JNDI lookup flaw in Apache Log4j 2 that allows remote code execution, disclosed in December 2021. CISA and partner agencies issued joint guidance on it as CVE-2021-44228, known as Log4Shell.
Description
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitation Context
as of October 14, 2026- CISA added CVE-2021-44228 to the KEV catalog on the day its CVE record was published.
- It is one of 41 Apache entries in the CISA KEV catalog, and one of 12 added in 2021.
- Its current EPSS score (100.0%) is higher than that of 97% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache Software Foundation | Apache Software Foundation Apache Log4j2 | 2.0-beta9 to <log4j-core* (fixed ≥ 2.3.1, 2.12.2, 2.15.0; affected again ≥ 2.4, 2.13.0) |
References
51 Links- [oss-security] 20211210 CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
- [oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
- [oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
- [debian-lts-announce] 20211212 [SECURITY] [DLA 2842-1] apache-log4j2 security update
- [oss-security] 20211213 Re: CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
- [oss-security] 20211213 CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
- [oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
- [oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
- 20220314 APPLE-SA-2022-03-14-7 Xcode 13.3
- 20220721 Open-Xchange Security Advisory 2022-07-21
- 20221208 Intel Data Center Manager <= 5.1 Local Privileges Escalation
- https://logging.apache.org/log4j/2.x/security.html
- https://security.netapp.com/advisory/ntap-20211210-0007/
- http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
- https://twitter.com/kurtseifried/status/1469345530182455296
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
- http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
- http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
- http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
- http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
- http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
- http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
- http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
- http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
- https://www.oracle.com/security-alerts/cpujan2022.html
- http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html
- https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md
- http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html
- https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001
- https://github.com/cisagov/log4j-affected-db
- https://support.apple.com/kb/HT213189
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228
- https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html
- http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
- http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html
Record Details
More from Apache
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
Apache Struts Remote Code Execution Vulnerability
mod_proxy SSRF
Apache Struts Improper Input Validation Vulnerability
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.