CVE-2021-44228

10.0 criticalKEVEPSS 100%

Critical (10.0) in Apache Log4j2. In CISA KEV since 2021-12-10, with known ransomware use. EPSS 100% chance of exploitation in the next 30 days. Fixed in org.apache.logging.log4j:log4j-core 2.12.2, 2.15.0, 2.3.1.

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Severity

CVSS 3.1

10.0 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 100% chance of exploitation in the next 30 days; higher than 100% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2021-12-10, due 2021-12-24, known ransomware use
CWEs: CWE-20, CWE-400, CWE-502, CWE-917
Published: 2021-12-10
Modified: 2026-08-11
Record from: the NVD, synced 2026-10-19

Affected

apache:log4j
apple:xcode
bentley:synchro
bentley:synchro_4d
cisco:advanced_malware_protection_virtual_private_cloud_appliance
cisco:automated_subsea_tuning
cisco:broadworks
cisco:business_process_automation
cisco:cloud_connect
cisco:cloudcenter
cisco:cloudcenter_cost_optimizer
cisco:cloudcenter_suite
cisco:cloudcenter_suite_admin
cisco:cloudcenter_workload_manager
cisco:common_services_platform_collector
cisco:connected_mobile_experiences
cisco:contact_center_domain_manager
cisco:contact_center_management_portal
cisco:crosswork_data_gateway
cisco:crosswork_network_automation
cisco:crosswork_network_controller
cisco:crosswork_optimization_engine
cisco:crosswork_platform_infrastructure
cisco:crosswork_zero_touch_provisioning
cisco:customer_experience_cloud_agent
cisco:cx_cloud_agent
cisco:cyber_vision
cisco:cyber_vision_sensor_management_extension
cisco:data_center_network_manager
cisco:dna_center
cisco:dna_spaces
cisco:dna_spaces\
cisco:dna_spaces_connector
cisco:emergency_responder
cisco:enterprise_chat_and_email
cisco:evolved_programmable_network_manager
cisco:finesse
cisco:fog_director
cisco:fxos
cisco:identity_services_engine
cisco:integrated_management_controller_supervisor
cisco:intersight_virtual_appliance
cisco:iot_operations_dashboard
cisco:mobility_services_engine
cisco:network_assurance_engine
cisco:network_dashboard_fabric_controller
cisco:network_insights_for_data_center
cisco:network_services_orchestrator
cisco:nexus_dashboard
cisco:nexus_insights

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-jfh8-c2jp-5v3q	Maven	org.apache.logging.log4j:log4j-core	>=2.13.0 <2.15.0	2.15.0
GHSA-jfh8-c2jp-5v3q	Maven	org.apache.logging.log4j:log4j-core	>=2.0-beta9 <2.3.1	2.3.1
GHSA-jfh8-c2jp-5v3q	Maven	org.apache.logging.log4j:log4j-core	>=2.4 <2.12.2	2.12.2
GHSA-jfh8-c2jp-5v3q	Maven	com.guicedee.services:log4j-core	<=1.2.1.2-jre17	no fix published
GHSA-jfh8-c2jp-5v3q	Maven	org.xbib.elasticsearch:log4j	6.3.2.1	no fix published
GHSA-jfh8-c2jp-5v3q	Maven	uk.co.nichesolutions.logging.log4j:log4j-core	2.6.3-CUSTOM	no fix published
GHSA-jfh8-c2jp-5v3q	Maven	org.ops4j.pax.logging:pax-logging-log4j2	>=1.8.0 <1.9.2	1.9.2
GHSA-jfh8-c2jp-5v3q	Maven	org.ops4j.pax.logging:pax-logging-log4j2	>=1.10.0 <1.10.8	1.10.8
GHSA-jfh8-c2jp-5v3q	Maven	org.ops4j.pax.logging:pax-logging-log4j2	>=1.11.0 <1.11.10	1.11.10
GHSA-jfh8-c2jp-5v3q	Maven	org.ops4j.pax.logging:pax-logging-log4j2	>=2.0.0 <2.0.11	2.0.11

References

Check your stack JSON