Snapshot of public data from 31 Oct 2026, 12:50:06. This data is not updated until the API is deployed.

CVE-2021-44228

Apache Log4j2 Remote Code Execution Vulnerability

UrgentCVSS 10.0 v3.1Exploited

Why this priority

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

Présent dans le catalogue CISA KEV (exploitation confirmée)

Description

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Affected products

Vendor	Product	Versions
Apache Software Foundation	Apache Log4j2	from 2.0-beta9 to log4j-core* excluded
Apache	Log4j2	All versions

Revision history

Revision 3 31 Oct 2026, 12:49:45
Revision 2 31 Oct 2026, 12:27:42
Update : Affected versions changed
Revision 1 31 Oct 2026, 12:27:08
New record

Qualification

CVSS severity ? Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary: 10.0 CRITICAL CVSS v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
KEV catalog ? CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary: Listed
Exploitation: Confirmed
EPSS probability ? Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary: Unknown
Confidence ? Quality of the sources behind the record. It is not a risk score. See the glossary: High

Priority rules, version 1

CISA KEV catalog

Added on: 10 December 2021
Federal due date: 24 December 2021
Required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Ransomware use: Known