CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability

CVSS: 10.0v3.1CriticalKEVRansomwareAnalyzed

AliasesMGASA-2021-0556UBUNTU-CVE-2021-44228USN-5192-1+11 more

Published 10-12-2021Last modified 21-10-2025

Vulnerability summary

CVE-2021-44228 is a critical (CVSS 10.0) Improper Input Validation vulnerability in Apache Log4j2. It is known to be exploited: CISA and CIRCL list it, first on 10-12-2021. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 19 public exploits are recorded.

Overall risk

100/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

Critical · v3.1 (CVE.org)

EPSS score

100.00%

0%100%

Critical · 0.00 pp in 30 days

KEVListedCISA · CIRCL

RansomwareKnown useFlagged by CISA

Public exploits19github, reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 8 · Related 6

OPENSUSE-SU-2021:1601-1 OPENSUSE-SU-2021:4094-1 OPENSUSE-SU-2021:4107-1 RHSA-2025:1746 RHSA-2025:1747 SUSE-SU-2021:4096-1+2 more

Timeline

10-12-2021
PublishedVulnerability first disclosed.
10-12-2021
Added to CISA KEVApache Log4j2 Remote Code Execution Vulnerability
24-12-2021
CISA remediation dueApply mitigations per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.
03-09-2026
Added to CIRCL KEVAdded to the CIRCL known exploited vulnerabilities catalog.

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.110.0v2.09.3

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 100.00% on 18-09-2026

18-09-202618-10-2026

EPSS score

100.00%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 10-12-2021
Federal due date: 24-12-2021

CIRCLListed

Added: 03-09-2026

CISA required action

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at cisa.gov/uscert/ed-22-02-apache-log4j-recommend… are only acceptable until updates are available. nvd.nist.gov/vuln/detail/CVE-2021-44228

Public exploits

19 found

githubUnverified
Cve Mitre
Maturity: poc
referenceUnverified
Exploit Reference (twitter.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 19 exploits

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (nu11secur1ty.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
exploit-databaseremotejavaUnverified
AD Manager Plus 7122 - Remote Code Execution (RCE)
Maturity: poc
exploit-databaseremotejavaUnverified
Apache Log4j 2 - Remote Code Execution (RCE)
Maturity: poc
exploit-databaseremotejavaUnverified
Apache Log4j2 2.14.1 - Information Disclosure
Maturity: poc
MetasploitremoteUnverified
Log4Shell HTTP Scanner
auxiliary/scanner/http/log4shell_scanner
Maturity: poc
MetasploitremoteVerified
MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell)
exploit/linux/http/mobileiron_core_log4shell
Maturity: weaponized
MetasploitremoteVerified
Log4Shell HTTP Header Injection
exploit/multi/http/log4shell_header_injection
Maturity: weaponized
MetasploitremoteVerified
UniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell)
exploit/multi/http/ubiquiti_unifi_log4shell
Maturity: weaponized
MetasploitremoteVerified
VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell)
exploit/multi/http/vmware_vcenter_log4shell
Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Cisco75 products

advanced_malware_protection_virtual_private_cloud_appliance< 3.5.4
automated_subsea_tuning< 2.1.0 | 02.01.00
broadworks< 2021.11_1.162 | na
business_process_automation< 3.0.000.115 | ≥ 3.1.000.000, < 3.1.000.044 | ≥ 3.2.000.000, < 3.2.000.009
cloud_connect< 12.6\(1\)

Show all 75

Siemens30 products

Show all 30

Netapp10 products

Show all 10

Intel6 products

Show all 6

Opensuse5 products

log4j&distro=openSUSE Leap 15.2< 2.13.0-lp152.3.3.1 | < 2.13.0-lp152.3.6.1
log4j&distro=openSUSE Leap 15.3< 2.13.0-4.3.1
log4j&distro=openSUSE Tumbleweed< 2.13.2-2.1
logback&distro=openSUSE Leap 15.2< 1.2.8-lp152.2.3.2
logback&distro=openSUSE Leap 15.3< 1.2.8-3.3.1

Bentley2 products

synchro≥ 6.1, < 6.2.4.2
synchro_4d< 6.4.3.2

Debian2 products

apache-log4j2< 2.15.0-1 | < 2.15.0-1~deb10u1 | < 2.15.0-1~deb11u1 | < 2.7-2+deb9u1
debian_linuxEOL9.0 | 10.0 | 11.0

Snowsoftware2 products

snow_commander< 8.10.0
vm_access_proxy< 3.6

Apache1 product

log4j≥ 2.0.1, < 2.3.1 | ≥ 2.4.0, < 2.12.2 | ≥ 2.13.0, < 2.15.0 | 2.0 | 2.0:beta9 | 2.0:rc1 | 2.0:rc2

Apache software foundation1 product

apache log4j2≥ 2.0-beta9, < log4j-core*

Apple1 product

xcode< 13.3

Com.guicedee.services1 product

log4j-core≤ 1.2.1.2-jre17

Fedoraproject1 product

fedoraEOL34 | 35

Mageia1 product

log4j< 2.13.3-1.1.mga8

Org.apache.logging.log4j1 product

log4j-core≥ 2.13.0, < 2.15.0 | ≥ 2.0-beta9, < 2.3.1 | ≥ 2.4, < 2.12.2

Org.ops4j.pax.logging1 product

pax-logging-log4j2≥ 1.8.0, < 1.9.2 | ≥ 1.10.0, < 1.10.8 | ≥ 1.11.0, < 1.11.10 | ≥ 2.0.0, < 2.0.11

Org.xbib.elasticsearch1 product

log4j6.3.2.1

Percussion1 product

rhythmyx≤ 7.3.2

Sonicwall1 product

email_security< 10.0.13

Ubuntu1 product

apache-log4j2< 2.10.0-2ubuntu0.1 | < 2.15.0-0.20.04.1 | < 2.4-2ubuntu0.1~esm1

Uk.co.nichesolutions.logging.log4j1 product

log4j-core2.6.3-CUSTOM

21 vendors · 145 products

References

100 links

logging.apache.org/log4j/2.x/security.htmlWEBRelease NotesVendor Advisory
www.openwall.com/lists/oss-security/2021/12/10/1Mailing ListWEBMitigationThird Party Advisory
www.openwall.com/lists/oss-security/2021/12/10/2Mailing ListWEBMitigationThird Party Advisory
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdVendor AdvisoryWEBThird Party Advisory
www.openwall.com/lists/oss-security/2021/12/10/3Mailing ListWEBThird Party Advisory
security.netapp.com/advisory/ntap-20211210-0007/Third Party Advisory
packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlWEBThird Party AdvisoryVDB Entry
psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032WEBThird Party Advisory
www.oracle.com/security-alerts/alert-cve-2021-44228.htmlWEBThird Party Advisory
www.debian.org/security/2021/dsa-5020Vendor AdvisoryWEBMailing ListThird Party Advisory

Show all 100 references

lists.debian.org/debian-lts-announce/2021/12/msg00007.htmlMailing ListWEBThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryRelease Notes
msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/Vendor AdvisoryPatchThird Party Advisory
www.openwall.com/lists/oss-security/2021/12/13/2Mailing ListWEBThird Party Advisory
www.openwall.com/lists/oss-security/2021/12/13/1Mailing ListWEBThird Party Advisory
www.openwall.com/lists/oss-security/2021/12/14/4Mailing ListWEBThird Party Advisory
www.kb.cert.org/vuls/id/930724Third Party AdvisoryWEBUS Government Resource
twitter.com/kurtseifried/status/1469345530182455296WEBBroken LinkExploitThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-661247.pdfWEBThird Party Advisory
packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.htmlWEBThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlWEBExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.htmlWEBExploitThird Party AdvisoryVDB Entry
www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.htmlWEBThird Party Advisory
www.openwall.com/lists/oss-security/2021/12/15/3Mailing ListWEBThird Party Advisory
packetstormsecurity.com/files/165282/Log4j-Payload-Generator.htmlWEBThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.htmlWEBThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.htmlWEBThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.htmlWEBBroken LinkThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.htmlWEBThird Party AdvisoryVDB Entry
cert-portal.siemens.com/productcert/pdf/ssa-714170.pdfWEBThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryRelease Notes
packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.htmlWEBExploitThird Party AdvisoryVDB Entry
cert-portal.siemens.com/productcert/pdf/ssa-397453.pdfWEBThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfWEBThird Party Advisory
www.oracle.com/security-alerts/cpujan2022.htmlWEBPatchThird Party Advisory
packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.htmlWEBExploitThird Party AdvisoryVDB Entry
github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.mdWEBBroken LinkProductUS Government Resource
packetstormsecurity.com/files/…WEBExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/…WEBExploitThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2022/Mar/23Mailing ListWEBThird Party Advisory
www.bentley.com/en/common-vulnerability-exposure/be-2022-0001WEBThird Party Advisory
github.com/cisagov/log4j-affected-dbWEBThird Party Advisory
support.apple.com/kb/HT213189WEBThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlWEBPatchThird Party Advisory
github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228WEBExploitThird Party Advisory
www.nu11secur1ty.com/2021/12/cve-2021-44228.htmlWEBExploitThird Party Advisory
seclists.org/fulldisclosure/2022/Jul/11Mailing ListWEBThird Party Advisory
packetstormsecurity.com/files/…WEBThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.htmlWEBExploitThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2022/Dec/2Mailing ListWEBExploitThird Party Advisory
packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.htmlWEBThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228Government ResourceWEBThird Party AdvisoryUS Government Resource
advisories.mageia.org/MGASA-2021-0556.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=29753REPORT
www.openwall.com/lists/oss-security/2021/12/10/1WEB
ubuntu.com/security/CVE-2021-44228REPORT
wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4ShellREPORT
github.com/apache/logging-log4j2/pull/608REPORTWEB
github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3REPORT
github.com/tangxiaofeng7/apache-log4j-pocREPORTWEB
github.com/advisories/GHSA-jfh8-c2jp-5v3qREPORT
ubuntu.com/security/notices/USN-5192-1Advisory
ubuntu.com/security/notices/USN-5197-1Advisory
ubuntu.com/security/notices/USN-5192-2Advisory
www.cve.org/CVERecord?id=CVE-2021-44228REPORT
www.cisa.gov/known-exploited-vulnerabilities-catalogREPORT
security-tracker.debian.org/tracker/CVE-2021-44228Advisory
lists.opensuse.org/archives/…Advisory
bugzilla.suse.com/1193611REPORT
www.suse.com/security/cve/CVE-2021-44228WEB
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
bugzilla.suse.com/1193795REPORT
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
nvd.nist.gov/vuln/detail/CVE-2021-44228Advisory
github.com/github/advisory-database/pull/5501WEB
packetstormsecurity.com/files/…WEB
packetstormsecurity.com/files/…WEB
packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.htmlWEB
packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.htmlWEB
sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdWEB
seclists.org/fulldisclosure/2022/Dec/2WEB
seclists.org/fulldisclosure/2022/Jul/11WEB
seclists.org/fulldisclosure/2022/Mar/23WEB
security.netapp.com/advisory/ntap-20211210-0007WEB
github.com/advisories/GHSA-7rjr-3q55-vv33Advisory
github.com/apache/logging-log4j2PACKAGE
issues.apache.org/jira/browse/LOG4J2-3198WEB
issues.apache.org/jira/browse/LOG4J2-3201WEB
issues.apache.org/jira/browse/LOG4J2-3214WEB
issues.apache.org/jira/browse/LOG4J2-3221WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
logging.apache.org/log4j/2.x/changes-report.htmlWEB
logging.apache.org/log4j/2.x/manual/lookups.htmlWEB
logging.apache.org/log4j/2.x/manual/migration.htmlWEB
msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities