CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability

Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days.

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Affected products

Apache LOG4J: from 2.0.1, before 2.3.1 (fixed in 2.3.1); from 2.4.0, before 2.12.2 (fixed in 2.12.2); from 2.13.0, before 2.15.0 (fixed in 2.15.0); version 2.0 only
Apple Xcode: before 13.3 (fixed in 13.3)
Bentley Synchro: from 6.1, before 6.2.4.2 (fixed in 6.2.4.2)
Bentley Synchro 4d: before 6.4.3.2 (fixed in 6.4.3.2)
Cisco Advanced Malware Protection Virtual Private Cloud Appliance: before 3.5.4 (fixed in 3.5.4)
Cisco Automated Subsea Tuning: before 2.1.0 (fixed in 2.1.0); version 02.01.00 only
Cisco Broadworks: before 2021.11_1.162 (fixed in 2021.11_1.162); affected versions not specified
Cisco Business Process Automation: before 3.0.000.115 (fixed in 3.0.000.115); from 3.1.000.000, before 3.1.000.044 (fixed in 3.1.000.044); from 3.2.000.000, before 3.2.000.009 (fixed in 3.2.000.009)
Cisco Cloud Connect: before 12.6\(1\) (fixed in 12.6\(1\))
Cisco Cloudcenter: before 4.10.0.16 (fixed in 4.10.0.16)
Cisco Cloudcenter Cost Optimizer: before 5.5.2 (fixed in 5.5.2)
Cisco Cloudcenter Suite: version 4.10.0.15 only; version 5.3.0 only; version 5.4.1 only; version 5.5.0 only; version 5.5.1 only
Cisco Cloudcenter Suite Admin: before 5.3.1 (fixed in 5.3.1)
Cisco Cloudcenter Workload Manager: before 5.5.2 (fixed in 5.5.2)
Cisco Common Services Platform Collector: before 2.9.1.3 (fixed in 2.9.1.3); from 2.10.0, before 2.10.0.1 (fixed in 2.10.0.1); version 002.009(000.000) only; version 002.009(000.001) only; version 002.009(000.002) only; version 002.009(001.000) only; …
Cisco Connected Mobile Experiences: affected versions not specified
Cisco Contact Center Domain Manager: before 12.5\(1\) (fixed in 12.5\(1\))
Cisco Contact Center Management Portal: before 12.5\(1\) (fixed in 12.5\(1\))
Cisco Crosswork Data Gateway: before 2.0.2 (fixed in 2.0.2); version 3.0.0 only
Cisco Crosswork Network Automation: affected versions not specified; version 2.0.0 only; version 3.0.0 only; version 4.1.0 only; version 4.1.1 only
Cisco Crosswork Network Controller: before 2.0.1 (fixed in 2.0.1); version 3.0.0 only
Cisco Crosswork Optimization Engine: before 2.0.1 (fixed in 2.0.1); version 3.0.0 only
Cisco Crosswork Platform Infrastructure: before 4.0.1 (fixed in 4.0.1); version 4.1.0 only
Cisco Crosswork Zero Touch Provisioning: before 2.0.1 (fixed in 2.0.1); version 3.0.0 only
Cisco Customer Experience Cloud Agent: before 1.12.1 (fixed in 1.12.1)
and 118 more

Published 2021-12-10. Last modified 2026-08-11.