CISA KEV Critical
Input validation exploit reference
CVE-2021-44228 — Apache Log4j2 Remote Code Execution Vulnerability
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
100
Urgent
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
CISA KEV · Dec 10, 2021 R contiR nightsky ☠ APT41☠ Magic Hound☠ Sea Turtle Detection templates (Nuclei) · 1Metasploit modules · 5Exploit-DB · 3Proofs of concept on GitHub · 457
How the score was calculated
- Confirmed exploitation (CISA KEV)+35
- Used in ransomware campaigns (CISA)+10
- Exploited by 3 threat actor(s) (MITRE ATT&CK)+10
- Public exploit/PoC (nuclei, metasploit, exploitdb, github)+20
- EPSS 100% (30-day exploitation probability)+15
- Technical severity (critical)+10
- Automatable exploitation (SSVC)+3
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
Exploitation
Confirmed
CISA KEV, listed Dec 10, 2021
EPSS FIRST
100%
ahead of 100% of scored CVEs · Oct 15, 2026
Affects
Apache Software Foundation
Apache Log4j2 and 97 more
CVSS base
10.0
Critical · 4 source(s)
CISA SSVC assessment CISA
Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.
Exploitation
Active
none · proof-of-concept · active
Automatable
Yes
can an attacker script the kill-chain steps
Technical impact
Total
partial · total control of the vulnerable component
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
- Documented mitigation — www.openwall.com (NIST National Vulnerability Database)
- Documented mitigation — www.openwall.com (NIST National Vulnerability Database)
- Documented patch — msrc-blog.microsoft.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Maven Org.apache.logging.log4j:log4j-core: fixed in version 2.15.0 — github.com (GitHub Security Advisories)
- Maven Org.apache.logging.log4j:log4j-core: fixed in version 2.12.2 — github.com (GitHub Security Advisories)
- Maven Org.apache.logging.log4j:log4j-core: fixed in version 2.3.1 — github.com (GitHub Security Advisories)
- Maven Org.ops4j.pax.logging:pax-logging-log4j2: fixed in version 1.9.2 — github.com (GitHub Security Advisories)
- Maven Org.ops4j.pax.logging:pax-logging-log4j2: fixed in version 1.10.8 — github.com (GitHub Security Advisories)
- Maven Org.ops4j.pax.logging:pax-logging-log4j2: fixed in version 1.11.10 — github.com (GitHub Security Advisories)
- Maven Org.ops4j.pax.logging:pax-logging-log4j2: fixed in version 2.0.11 — github.com (GitHub Security Advisories)
CISA required action CISA
For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
US federal deadline: Dec 24, 2021 — passed 1757 day(s) ago
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (Apache Software Foundation Apache Log4j2, Apache Software Foundation Log4j, Apple Xcode…).
- Treat as emergency remediation: the CVE is in CISA KEV (confirmed exploitation).
- The attack is network-based and needs no privileges: restrict exposure (ACLs, VPN, WAF) until patched.
- Apply the fixed version or the patch documented under Remediation.
- EPSS ahead of 100% of scored CVEs: prioritize it in the patch queue.
- Search available logs for exploit probes matching the vulnerability class (input validation), errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| Apache Software Foundation | Apache Log4j2 | ≥ 2.0-beta9 and < log4j-core* | Vulnerable | CVE Program (cve.org) e CISA ADP |
| Apache Software Foundation | Log4j | ≥ 2.0.1 and < 2.3.1≥ 2.4.0 and < 2.12.2≥ 2.13.0 and < 2.15.0version 2.0version 2.0-beta9version 2.0-rc1version 2.0-rc2 | Vulnerable | NIST National Vulnerability Database |
| Apple | Xcode | < 13.3 | Vulnerable | NIST National Vulnerability Database |
| Bentley | Synchro | ≥ 6.1 and < 6.2.4.2 | Vulnerable | NIST National Vulnerability Database |
| Bentley | Synchro 4d | < 6.4.3.2 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Advanced Malware Protection Virtual Private Cloud Appliance | < 3.5.4 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Automated Subsea Tuning | < 2.1.0version 02.01.00 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Broadworks | < 2021.11_1.162versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Cisco | Business Process Automation | < 3.0.000.115≥ 3.1.000.000 and < 3.1.000.044≥ 3.2.000.000 and < 3.2.000.009 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Cloud Connect | < 12.6\(1\) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Cloudcenter | < 4.10.0.16 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Cloudcenter Cost Optimizer | < 5.5.2 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Cloudcenter Suite | version 4.10.0.15version 5.3.0version 5.4.1version 5.5.0version 5.5.1 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Cloudcenter Suite Admin | < 5.3.1 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Cloudcenter Workload Manager | < 5.5.2 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Common Services Platform Collector |
< 2.9.1.3≥ 2.10.0 and < 2.10.0.1version 002.009(000.000)version 002.009(000.001)version 002.009(000.002)version 002.009(001.000)version 002.009(001.001)version 002.009(001.002) and 1 moreversion 002.010(000.000) |
Vulnerable | NIST National Vulnerability Database |
| Cisco | Connected Mobile Experiences | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Cisco | Contact Center Domain Manager | < 12.5\(1\) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Contact Center Management Portal | < 12.5\(1\) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Crosswork Data Gateway | < 2.0.2version 3.0.0 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Crosswork Network Automation | versions not specified by the sourceversion 2.0.0version 3.0.0version 4.1.0version 4.1.1 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Crosswork Network Controller | < 2.0.1version 3.0.0 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Crosswork Optimization Engine | < 2.0.1version 3.0.0 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Crosswork Platform Infrastructure | < 4.0.1version 4.1.0 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Crosswork Zero Touch Provisioning | < 2.0.1version 3.0.0 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Customer Experience Cloud Agent | < 1.12.1 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Cx Cloud Agent | version 001.012 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Cyber Vision | version 4.0.2 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Cyber Vision Sensor Management Extension | < 4.0.3version 4.0.2 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Data Center Network Manager | < 11.3\(1\)version 11.3(1) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Dna Center | < 2.1.2.8≥ 2.2.2.0 and < 2.2.2.8≥ 2.2.3.0 and < 2.2.3.4version 2.2.2.8 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Dna Spaces | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Cisco | Dna Spaces: Connector | < 2.5versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Cisco | Emergency Responder | < 11.5\(4\)version 11.5version 11.5(4.65000.14)version 11.5(4.66000.14) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Enterprise Chat And Email | < 12.0\(1\)version 12.0(1)version 12.5(1)version 12.6(1) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Evolved Programmable Network Manager | ≤ 4.1.1version 3.0version 3.1version 4.0version 4.1version 5.0version 5.1 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Finesse | < 12.6\(1\)version 12.6(1)version 12.5(1)-su1version 12.5(1)-su2version 12.6(1)-es01version 12.6(1)-es02version 12.6(1)-es03 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Fog Director | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Cisco | Fxos | version 6.2.3version 6.3.0version 6.4.0version 6.5.0version 6.6.0version 6.7.0version 7.0.0version 7.1.0 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Identity Services Engine | < 2.4.0version 2.4.0version 002.004(000.914)version 002.006(000.156)version 002.007(000.356)version 003.000(000.458)version 003.001(000.518)version 003.002(000.116) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Integrated Management Controller Supervisor | < 2.3.2.1version 002.003(002.000)version 2.3.2.0 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Intersight Virtual Appliance | < 1.0.9-361version 1.0.9-343 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Iot Operations Dashboard | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Cisco | Mobility Services Engine | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Cisco | Network Assurance Engine | < 6.0.2version 6.0(2.1912) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Network Dashboard Fabric Controller | version 11.0(1)version 11.1(1)version 11.2(1)version 11.3(1)version 11.4(1)version 11.5(1)version 11.5(2)version 11.5(3) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Network Insights For Data Center | version 6.0(2.1914) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Network Services Orchestrator | < 5.3.5.1≥ 5.4 and < 5.4.5.2≥ 5.5 and < 5.5.4.1≥ 5.6 and < 5.6.3.1versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Cisco | Nexus Dashboard | < 2.1.2 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Nexus Insights | < 6.0.2 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Optical Network Controller | < 1.1.0version 1.1 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Packaged Contact Center Enterprise | < 11.6version 11.6(1) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Paging Server |
< 14.4.1version 8.3(1)version 8.4(1)version 8.5(1)version 9.0(1)version 9.0(2)version 9.1(1)version 12.5(2) and 1 moreversion 14.0(1) |
Vulnerable | NIST National Vulnerability Database |
| Cisco | Prime Service Catalog | < 12.1version 12.1 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Sd-wan Vmanage |
< 20.3.4.1≥ 20.4 and < 20.4.2.1≥ 20.5 and < 20.5.1.1≥ 20.6 and < 20.6.2.1version 20.3version 20.4version 20.5version 20.6 and 3 moreversion 20.6.1version 20.7version 20.8 |
Vulnerable | NIST National Vulnerability Database |
| Cisco | Secure Firewall Threat Defense | version 6.2.3version 6.3.0version 6.4.0version 6.5.0version 6.6.0version 6.7.0version 7.0.0version 7.1.0 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Smart Phy | < 3.2.1version 3.1.2version 3.1.3version 3.1.4version 3.1.5version 3.2.1version 21.3 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Ucs Central | < 2.0\(1p\) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Ucs Central Software |
version 2.0version 2.0(1a)version 2.0(1b)version 2.0(1c)version 2.0(1e)version 2.0(1d)version 2.0(1l)version 2.0(1k) and 3 moreversion 2.0(1h)version 2.0(1g)version 2.0(1f) |
Vulnerable | NIST National Vulnerability Database |
| Cisco | Ucs Director | < 6.8.2.0 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Communications Manager | < 11.5\(1\)version 11.5(1)version 11.5(1)su3version 11.5(1.17900.52)version 11.5(1.18119.2)version 11.5(1.18900.97)version 11.5(1.21900.40)version 11.5(1.22900.28) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Communications Manager Im & Presence Service | version 11.5(1)version 11.5(1.22900.6) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Communications Manager Im And Presence Service | < 11.5\(1\)version 11.5(1) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Computing System | version 006.008(001.000) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Contact Center Enterprise | < 11.6\(2\)version 11.6(2)version 12.0(1)version 12.5(1)version 12.6(1)version 12.6(2) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Contact Center Express | < 12.5\(1\)version 12.5(1)version 12.5(1)-su1version 12.6(1)version 12.6(2) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Contact Center Management Portal | version 12.6(1) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Customer Voice Portal | < 11.6version 11.6version 12.0version 12.5version 11.6(1)version 12.0(1)version 12.5(1)version 12.6(1) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Intelligence Center | < 12.6\(1\)version 12.6(1)version 12.6(1)-es01version 12.6(1)-es02version 12.6(2) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Sip Proxy | < 10.2.1v2version 010.000(000)version 010.000(001)version 010.002(000)version 010.002(001) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unified Workforce Optimization | < 11.5\(1\)version 11.5(1)-sr7 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Unity Connection | < 11.5\(1\)version 11.5version 11.5(1.10000.6) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Video Surveillance Manager | version 7.14(1.26)version 7.14(2.26)version 7.14(3.025)version 7.14(4.018) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Video Surveillance Operations Manager | < 7.14.4 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Virtual Topology System | < 2.6.7version 2.6.6 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Virtualized Infrastructure Manager | < 3.2.0≥ 3.4.0 and < 3.4.4 | Vulnerable | NIST National Vulnerability Database |
| Cisco | Virtualized Voice Browser | < 12.5\(1\) | Vulnerable | NIST National Vulnerability Database |
| Cisco | Wan Automation Engine |
< 7.3.0.2version 7.1.3version 7.2.1version 7.2.2version 7.2.3version 7.3version 7.4version 7.5 and 1 moreversion 7.6 |
Vulnerable | NIST National Vulnerability Database |
| Cisco | Webex Meetings Server |
< 3.0version 3.0version 3.0-maintenance_release1version 3.0-maintenance_release2version 3.0-maintenance_release3version 3.0-maintenance_release3_security_patch4version 3.0-maintenance_release3_security_patch5version 3.0-maintenance_release3_service_pack_2 and 6 moreversion 3.0-maintenance_release3_service_pack_3version 3.0-maintenance_release4version 4.0version 4.0-maintenance_release1version 4.0-maintenance_release2version 4.0-maintenance_release3 |
Vulnerable | NIST National Vulnerability Database |
| Cisco | Workload Optimization Manager | < 3.2.1 | Vulnerable | NIST National Vulnerability Database |
| Debian | Debian Linux | version 9.0version 10.0version 11.0 | Vulnerable | NIST National Vulnerability Database |
| Fedoraproject | Fedora | version 34version 35 | Vulnerable | NIST National Vulnerability Database |
| Intel | Computer Vision Annotation Tool | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Intel | Datacenter Manager | < 5.1 | Vulnerable | NIST National Vulnerability Database |
| Intel | Genomics Kernel Library | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Intel | Oneapi Sample Browser | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Intel | Secure Device Onboard | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Intel | System Studio | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Active Iq Unified Manager | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Brocade San Navigator | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Cloud Insights | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Cloud Manager | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Cloud Secure Agent | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Oncommand Insight | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Ontap Tools | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Snapcenter | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Solidfire & Hci Storage Node | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Solidfire Enterprise Sds | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
Attack characteristics
The CVSS vector, decoded. It describes the attack, not your exposure to it.
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Every base score collected
Sources score independently and may disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Scored by |
|---|---|---|---|---|---|
| 10.0 | CVSS 3.1 | Critical | 3.9 | 6.0 | nvd@nist.gov via NIST National Vulnerability Database |
| 10.0 | CVSS 3.1 | Critical | 3.9 | 6.0 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 via NIST National Vulnerability Database |
| 10.0 | CVSS 3.1 | Critical | — | — | GitHub, Inc. via GitHub Security Advisories |
| 10.0 | CVSS 3.1 | Critical | — | — | CISA-ADP via CVE Program (cve.org) e CISA ADP |
| 9.3 | CVSS 2.0 | High | 8.6 | 10.0 | nvd@nist.gov via NIST National Vulnerability Database |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (score shown at the top: nvd@nist.gov) Weakness MITRE
Weakness class according to MITRE’s CWE catalog.
CISA KEV details CISA
CISA lists a CVE once it has evidence of exploitation against real targets.
Listed
Dec 10, 2021
Federal deadline
Dec 24, 2021
passed 1757 day(s) ago
Ransomware use
Known
CISA records ransomware use only for campaigns it has confirmed, so “Unknown” means unrecorded, not ruled out. The deadline binds US federal agencies; for everyone else it is a reference date.
Public exploits, PoCs and detection templates
Public code that demonstrates or tests the flaw raises the odds of mass exploitation — and Nuclei templates help find vulnerable assets in your environment.
Detection templates (Nuclei)
Metasploit modules
- Log4Shell HTTP Scanner normal Dec 9, 2021
- Log4Shell HTTP Header Injection excellent Dec 9, 2021
- UniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell) excellent Dec 9, 2021
- VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell) excellent Dec 9, 2021
- MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell) excellent Dec 12, 2021
Exploit-DB
- Apache Log4j2 2.14.1 - Information Disclosure Dec 14, 2021
- Apache Log4j 2 - Remote Code Execution (RCE) Dec 14, 2021
- AD Manager Plus 7122 - Remote Code Execution (RCE) Apr 1, 2023
Proofs of concept on GitHub — 457 repositories; showing the 10 most starred
- A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228 ★ 3429 Dec 13, 2021
- A Proof-Of-Concept for the CVE-2021-44228 vulnerability. ★ 1847 Dec 10, 2021
- Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228). ★ 1143 Dec 10, 2021
- 🐱💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks ★ 951 Dec 10, 2021
- Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228 ★ 863 Dec 11, 2021
- CVE-2021-44228 Log4j2 BurpSuite Scanner,Customize ceye.io api or other apis,including internal networks ★ 842 Dec 11, 2021
- A public open sourced tool. Log4J scanner that detects vulnerable Log4J versions (CVE-2021-44228, CVE-2021-45046, etc) on your file-system within any application. It is able to even find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java ★ 641 Dec 12, 2021
- An agent to hotpatch the log4j RCE from CVE-2021-44228. ★ 497 Dec 12, 2021
- Remote Code Injection In Log4j ★ 470 Dec 10, 2021
- Find vulnerable Log4j2 versions on disk and also inside Java Archive Files (Log4Shell CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) ★ 439 Dec 14, 2021
Warning: public PoCs are sometimes disguised malware. Use them only for authorized testing in an isolated environment. This portal does not host exploit code — it only points to the sources.
Threat actors exploiting this CVE MITRE ATT&CK
According to MITRE ATT&CK.
APT41 G0096Magic Hound G0059Sea Turtle G1041Associated ransomware groups ransomware.live
continightskyEPSS over time FIRST
Oct 13, 2026 → Oct 15, 2026 · 3 reading(s) · max 100.00%
Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Prioritize edge telemetry for the network-reachable component (proxy, WAF, IDS/IPS).
- Hunt retroactively in logs from before Dec 10, 2021 (KEV listing): exploitation may have started earlier.
Timeline
What happened to this CVE, newest first.
- 2026
- Fix documented
- Affected products added · maven/org.apache.logging.log4j:log4j-core, maven/com.guicedee.services:log4j-core, maven/org.xbib.elasticsearch:log4j, m
- Affected products added · apache software foundation/apache log4j2
- SSVC assessment updated
- Record published
- Fix documented
- Affected products added · siemens/6bk1602-0aa12-0tp0 firmware, siemens/6bk1602-0aa22-0tp0 firmware, siemens/6bk1602-0aa32-0tp0 firmware, siemens/6
- CVSS changed · 10.0
- Source status changed · → Analyzed
- Added to CISA KEV (detected)
- Record created in this database
- 2021
- CVE published
- Added to CISA KEV catalog
Source activity
Repeated readings are counted rather than listed.
- 2× References added · Oct 13, 2026 – Oct 13, 2026
- 1× Official description updated · Oct 13, 2026 – Oct 13, 2026
References
79 on the record
- logging.apache.org/log4j/2.x/security.html
- www.oracle.com/security-alerts/cpujan2022.html
- msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
- www.oracle.com/security-alerts/cpuapr2022.html
- www.openwall.com/lists/oss-security/2021/12/10/1
- www.openwall.com/lists/oss-security/2021/12/10/2
- github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md
- seclists.org/fulldisclosure/2022/Jul/11
- cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
- www.openwall.com/lists/oss-security/2021/12/10/3
- issues.apache.org/jira/browse/LOG4J2-3201
- packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
- www.cisa.gov/known-exploited-vulnerabilities-catalog
- security.netapp.com/advisory/ntap-20211210-0007/
- packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html
- support.apple.com/kb/HT213189
- packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html
- www.openwall.com/lists/oss-security/2021/12/14/4
- packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
- packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-q
- logging.apache.org/log4j/2.x/changes-report.html
- seclists.org/fulldisclosure/2022/Dec/2
- logging.apache.org/log4j/2.x/manual/lookups.html
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-q
- www.openwall.com/lists/oss-security/2021/12/13/2
- github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228
- www.openwall.com/lists/oss-security/2021/12/13/1
- www.oracle.com/security-alerts/alert-cve-2021-44228.html
- packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Comma
- github.com/advisories/GHSA-7rjr-3q55-vv33
- psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- nvd.nist.gov/vuln/detail/CVE-2021-44228
- packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html
- seclists.org/fulldisclosure/2022/Mar/23
- github.com/tangxiaofeng7/apache-log4j-poc
- packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Comma
- packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Inj
- packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remo
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVU
- packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
- seclists.org/fulldisclosure/2022/Dec/2
- github.com/apache/logging-log4j2/pull/608
- github.com/cisagov/log4j-affected-db
- lists.debian.org/debian-lts-announce/2021/12/msg00007.html
- www.debian.org/security/2021/dsa-5020
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CS
- github.com/github/advisory-database/pull/5501
- security.netapp.com/advisory/ntap-20211210-0007
- packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
- github.com/advisories/GHSA-jfh8-c2jp-5v3q
- msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2
- packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
- issues.apache.org/jira/browse/LOG4J2-3198
- cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
- packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html
- packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remo
- packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CS
- seclists.org/fulldisclosure/2022/Mar/23
- www.nu11secur1ty.com/2021/12/cve-2021-44228.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57
- seclists.org/fulldisclosure/2022/Jul/11
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJ
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57
- www.kb.cert.org/vuls/id/930724
- cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
- packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html
- twitter.com/kurtseifried/status/1469345530182455296
- packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html
- www.bentley.com/en/common-vulnerability-exposure/be-2022-0001
- issues.apache.org/jira/browse/LOG4J2-3214
- www.openwall.com/lists/oss-security/2021/12/15/3
- packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
- issues.apache.org/jira/browse/LOG4J2-3221
- cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
- packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
- logging.apache.org/log4j/2.x/manual/migration.html
Elsewhere on this site
Related CVEs (same products)
- Critical CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability KEV 29d
- Medium CVE-2026-76449 Cisco Identity Services Engine SQL Injection Vulnerability 29d
- Medium CVE-2026-76450 Cisco Identity Services Engine SQL Injection Vulnerability 29d
- Medium CVE-2026-76451 Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability 29d
- Medium CVE-2026-76446 Cisco Identity Services Engine External Entity Injection Vulnerability 29d
- Medium CVE-2026-76447 Cisco Identity Services Engine Certificate Reload Vulnerability 29d
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2021-44228 is "Apache Log4j2 Remote Code Execution Vulnerability", rated Critical. It affects Apache Log4j2 (Apache Software Foundation); versions are in the scope table. It is in CISA KEV: there is evidence of real-world exploitation. CVSS 10.0 describes technical severity. EPSS 100.00% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.