CVEs / CVE-2021-44228

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability

Known exploited in the CISA KEV catalog since 10 Dec 2021
critical 10 CVSS 3.1 (NVD)
EPSS 99.9% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
Last changed at its sources 24 Oct 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2021-44228

Summary

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
CISA, Known Exploited Vulnerabilities catalog

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
The CVE record, via NVD · published 10 Dec 2021 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
Apache Software Foundation Apache Log4j2	from 2.0-beta9, before log4j-core*	log4j-core*

As stated by OSV
Product	Affected	Fixed in
org.apache.logging.log4j:log4j-core (Maven)	from 2.13.0, before 2.15.0	2.15.0
org.apache.logging.log4j:log4j-core (Maven)	from 2.0-beta9, before 2.3.1	2.3.1
org.apache.logging.log4j:log4j-core (Maven)	from 2.4, before 2.12.2	2.12.2
com.guicedee.services:log4j-core (Maven)	up to and including 1.2.1.2-jre17	—
org.ops4j.pax.logging:pax-logging-log4j2 (Maven)	from 1.8.0, before 1.9.2	1.9.2
org.ops4j.pax.logging:pax-logging-log4j2 (Maven)	from 1.10.0, before 1.10.8	1.10.8
org.ops4j.pax.logging:pax-logging-log4j2 (Maven)	from 1.11.0, before 1.11.10	1.11.10
org.ops4j.pax.logging:pax-logging-log4j2 (Maven)	from 2.0.0, before 2.0.11	2.0.11

Package versions from GHSA-jfh8-c2jp-5v3q.

Exploitation

In CISA KEV since	10 Dec 2021
Due date for US federal agencies	24 Dec 2021
Used in ransomware campaigns	Known
Required action	For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Severity

CVSS 3.1	10 critical `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` Scored by NVD
Weakness	CWE-20, CWE-400, CWE-502, CWE-917

References

CVE-2021-44228 on NVD
CVE-2021-44228 in the CISA KEV catalog
CVE-2021-44228 on OSV
http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html Broken Link, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Dec/2 Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jul/11 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/Mar/23 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/10/1 Mailing List, Mitigation, Third Party Advisory

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.