Apache Log4j2

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 10 Dec 2021, the same day the CVE record was published.

How likely is exploitation in the next 30 days?

100%

EPSS score, percentile 100 of all scored records

How severe?

10.0 Critical

CVSS v3.1 base score, from CISA's enrichment of the record

What should I do?

CISA deadline 24 Dec 2021. For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; Full text

Advisories and patches (5)

Which versions are affected?

Affected

2.0-beta9
from 2.4
from 2.13.0

Unaffected from 2.3.1; from 2.12.2; from 2.15.0

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

Required action, set by CISA

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

CISA due date for this action: 24 December 2021.

Advisories and patches

20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021 (Vendor advisory)
DSA-5020 (Vendor advisory)
FEDORA-2021-f0f501d01f (Vendor advisory)
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2 (Vendor advisory)
FEDORA-2021-66d6c484f3 (Vendor advisory)

Linked from CISA's catalog entry

https://nvd.nist.gov/vuln/detail/CVE-2021-44228

Affected products and versions

As listed in the CVE record.

Apache Software Foundation Apache Log4j2
Status	Versions
Affected	2.0-beta9
Unaffected	from 2.3.1
Affected	from 2.4
Unaffected	from 2.12.2
Affected	from 2.13.0
Unaffected	from 2.15.0

Versions the record lists as unaffected: 2.3.1, 2.12.2, 2.15.0.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

CISA added CVE-2021-44228 to its Known Exploited Vulnerabilities (KEV) catalog on 10 Dec 2021.
CISA marks it as known to be used in ransomware campaigns.
The due date CISA sets for the required action is 24 Dec 2021.
The CVE record was published on 10 Dec 2021, the same day it was added to KEV.
The CVE record carries a CVSS v3.1 base score of 10.0 (Critical), taken from CISA's enrichment of the record.
FIRST's EPSS model puts the probability of exploitation in the next 30 days at 100% (percentile 100), as of 28 Oct 2026.
CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

CWE-502: Deserialization of Untrusted Data
CWE-400: Uncontrolled Resource Consumption
CWE-20: Improper Input Validation

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

Date	Event
10 Dec 2021	CVE record published
10 Dec 2021	Added to CISA KEV
24 Dec 2021	CISA due date for the required action
21 Oct 2025	CVE record last updated

References

39 more in the CVE record.

More exploited Apache vulnerabilities

CVE-2016-3081: Apache Struts Command Injection Vulnerability (added 8 Oct 2026)
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (added 4 Aug 2026)
CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability (added 16 Apr 2026)
CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability (added 1 May 2025)
CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability (added 1 Apr 2025)
CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerability (added 4 Feb 2025)