Vulnerabilities/Apache/CVE-2021-44228

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownPatch available

CVSS 3.1 · NVD10.0Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 10 Dec 2021

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Recommended action

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

CISA due date 24 Dec 2021 · CWE-20, CWE-400, CWE-502

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
Apache Log4j22.0-beta9 to before log4j-core*; unaffected from 2.3.1; affected from 2.4; unaffected from 2.12.2; affected from 2.13.0; unaffected from 2.15.02.3.1, 2.12.2, 2.15.0

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 10 Dec 2021 · Added to CISA KEV
  • 24 Dec 2021 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.