WaratekVRT Sign in

CVE-2021-44228 Apache Log4j

Affected softwareApache Log4j
Severity10.0 Critical CVSS 3.1 3 scores
Fixed in2.15.0, 2.3.1, 2.12.2
WeaknessDeserialization of untrusted data (CWE-502)
Published10 Dec 2021
Updated11 Aug 2026

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

CWE-20 · Improper input validationCWE-400 · Uncontrolled resource consumptionCWE-917 · Expression language injection

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2021-12-10 · remediation due 2021-12-24 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 244 citations · honeypot sightings · 179 exploits · earliest 2021-12-06.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 478 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2021-12-09.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-44228 in VulnCheck (free account), which lists 239 more citations and 174 more exploit references not shown here.

EvidenceSourceDetailDate
Honeypot sighting SANS DShield sensors Exploitation attempts seen on 1 day 2021-12-10
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 1067 days 2023-11-15 to 2026-11-12
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 63 days 2025-10-14 to 2026-11-11
Reported exploitation cisa.gov /news-events/cybersecurity-advisories/aa21-336a 2021-12-06
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2021-12-10
Reported exploitation blog.netlab.360.com /threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets 2021-12-11
Reported exploitation microsoft.com /security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation 2021-12-11
Reported exploitation microsoft.com /security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation 2021-12-11
Exploit reference VulnCheck XDB d3b4139ec745 Exploit type: initial-access 0001-01-01
Exploit reference VulnCheck XDB 620853d6da36 Exploit type: initial-access 2021-12-09
Exploit reference VulnCheck XDB 2ae20daa876f Exploit type: initial-access 2021-12-10
Exploit reference VulnCheck XDB 2f6d2eab2b9e Exploit type: initial-access 2021-12-10
Exploit reference VulnCheck XDB 318993154b20 Exploit type: initial-access 2021-12-10
IndexArtifactStarsFirst seen
GitHub PoC A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228 3,424 2021-12-13
Nuclei Apache Log4j2 Remote Code Injection
Exploit-DB AD Manager Plus 7122 - Remote Code Execution (RCE) 2023-04-01
Metasploit Log4Shell HTTP Header Injection (excellent rank)
GitHub PoC A Proof-Of-Concept for the CVE-2021-44228 vulnerability. 1,843 2021-12-10
Exploit-DB Apache Log4j 2 - Remote Code Execution (RCE) 2021-12-14
Metasploit MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell) (excellent rank)
GitHub PoC Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228). 1,143 2021-12-10
Exploit-DB Apache Log4j2 2.14.1 - Information Disclosure 2021-12-14
Metasploit UniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell) (excellent rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2021-44228.armr patch rule, ARMR 2.6 added 2021-12-10 updated 2026-03-04
Sign in to download

How to mitigate CVE-2021-44228

Upgrade Apache Log4j to a release that fixes it: 2.15.0, 2.3.1 or 2.12.2. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

10.0 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H NVD Primary published
CVSS 3.1 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 9.3 none AV:N/AC:M/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Enterprise Manager / Load Testing for Web Apps (Apache Log4j) (13.3.0.1)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Enterprise Manager Load Testing for Web Apps (Apache Log4j) 13.3.0.1 13.3.0.1

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.logging.log4j:log4j-core 2.13.0 2.15.0 unbounded
org.apache.logging.log4j:log4j-core 2.0-beta9 2.3.1 unbounded
org.apache.logging.log4j:log4j-core 2.4 2.12.2 unbounded
com.guicedee.services:log4j-core 0 none 1.2.1.2-jre17
org.xbib.elasticsearch:log4j unspecified none unbounded
uk.co.nichesolutions.logging.log4j:log4j-core unspecified none unbounded
org.ops4j.pax.logging:pax-logging-log4j2 1.8.0 1.9.2 unbounded
org.ops4j.pax.logging:pax-logging-log4j2 1.10.0 1.10.8 unbounded
org.ops4j.pax.logging:pax-logging-log4j2 1.11.0 1.11.10 unbounded
org.ops4j.pax.logging:pax-logging-log4j2 2.0.0 2.0.11 unbounded

Products and versions

148 products, 370 version entries
SourceVendorProductSchemeAffected versions
nvd apache log4j generic 2.0 · 2.0:beta9 · 2.0:rc1 · 2.0:rc2 · ≥ 2.0.1 and ＜ 2.3.1 · ≥ 2.4.0 and ＜ 2.12.2 · ≥ 2.13.0 and ＜ 2.15.0
nvd apple xcode generic ＜ 13.3
nvd bentley synchro generic ≥ 6.1 and ＜ 6.2.4.2
nvd bentley synchro 4d generic ＜ 6.4.3.2
nvd cisco advanced malware protection virtual private cloud appliance generic ＜ 3.5.4
nvd cisco automated subsea tuning generic 02.01.00 · ＜ 2.1.0
nvd cisco broadworks generic any version · ＜ 2021.11.1.162
nvd cisco business process automation generic ＜ 3.0.0.115 · ≥ 3.1.0.0 and ＜ 3.1.0.44 · ≥ 3.2.0.0 and ＜ 3.2.0.9
nvd cisco cloud connect generic ＜ 12.6.1
nvd cisco cloudcenter generic ＜ 4.10.0.16
nvd cisco cloudcenter cost optimizer generic ＜ 5.5.2
nvd cisco cloudcenter suite generic 4.10.0.15 · 5.3.0 · 5.4.1 · 5.5.0 · 5.5.1
nvd cisco cloudcenter suite admin generic ＜ 5.3.1
nvd cisco cloudcenter workload manager generic ＜ 5.5.2
nvd cisco common services platform collector generic 002.009\(000.000\) · 002.009\(000.001\) · 002.009\(000.002\) · 002.009\(001.000\) · 002.009\(001.001\) · 002.009\(001.002\) · ＜ 2.9.1.3 · ≥ 2.10.0 and ＜ 2.10.0.1 · 002.010\(000.000\)
nvd cisco connected mobile experiences generic any version
nvd cisco contact center domain manager generic ＜ 12.5.1
nvd cisco contact center management portal generic ＜ 12.5.1
nvd cisco crosswork data gateway generic ＜ 2.0.2 · 3.0.0
nvd cisco crosswork network automation generic any version · 2.0.0 · 3.0.0 · 4.1.0 · 4.1.1
nvd cisco crosswork network controller generic ＜ 2.0.1 · 3.0.0
nvd cisco crosswork optimization engine generic ＜ 2.0.1 · 3.0.0
nvd cisco crosswork platform infrastructure generic ＜ 4.0.1 · 4.1.0
nvd cisco crosswork zero touch provisioning generic ＜ 2.0.1 · 3.0.0
nvd cisco customer experience cloud agent generic ＜ 1.12.1
nvd cisco cx cloud agent generic 001.012
nvd cisco cyber vision generic 4.0.2
nvd cisco cyber vision sensor management extension generic 4.0.2 · ＜ 4.0.3
nvd cisco data center network manager generic 11.3\(1\) · ＜ 11.3.1
nvd cisco dna center generic ＜ 2.1.2.8 · ≥ 2.2.2.0 and ＜ 2.2.2.8 · 2.2.2.8 · ≥ 2.2.3.0 and ＜ 2.2.3.4
nvd cisco dna spaces generic any version
nvd cisco dna spaces connector generic any version
nvd cisco dna spaces\ generic _connector
nvd cisco emergency responder generic 11.5 · ＜ 11.5.4 · 11.5\(4.65000.14\) · 11.5\(4.66000.14\)
nvd cisco enterprise chat and email generic 12.0\(1\) · ＜ 12.0.1 · 12.5\(1\) · 12.6\(1\)
nvd cisco evolved programmable network manager generic 3.0 · 3.1 · 4.0 · 4.1 · ≤ 4.1.1 · 5.0 · 5.1
nvd cisco finesse generic 12.5\(1\):su1 · 12.5\(1\):su2 · 12.6\(1\) · ＜ 12.6.1 · 12.6\(1\):es01 · 12.6\(1\):es02 · 12.6\(1\):es03
nvd cisco fog director generic any version
nvd cisco fxos generic 6.2.3 · 6.3.0 · 6.4.0 · 6.5.0 · 6.6.0 · 6.7.0 · 7.0.0 · 7.1.0
nvd cisco identity services engine generic 2.4.0 · ＜ 2.4.0 · 002.004\(000.914\) · 002.006\(000.156\) · 002.007\(000.356\) · 003.000\(000.458\) · 003.001\(000.518\) · 003.002\(000.116\)
nvd cisco integrated management controller supervisor generic 002.003\(002.000\) · 2.3.2.0 · ＜ 2.3.2.1
nvd cisco intersight virtual appliance generic 1.0.9-343 · ＜ 1.0.9.361
nvd cisco iot operations dashboard generic any version
nvd cisco mobility services engine generic any version
nvd cisco network assurance engine generic ＜ 6.0.2 · 6.0\(2.1912\)
nvd cisco network dashboard fabric controller generic 11.0\(1\) · 11.1\(1\) · 11.2\(1\) · 11.3\(1\) · 11.4\(1\) · 11.5\(1\) · 11.5\(2\) · 11.5\(3\)
nvd cisco network insights for data center generic 6.0\(2.1914\)
nvd cisco network services orchestrator generic any version · ＜ 5.3.5.1 · ≥ 5.4 and ＜ 5.4.5.2 · ≥ 5.5 and ＜ 5.5.4.1 · ≥ 5.6 and ＜ 5.6.3.1
nvd cisco nexus dashboard generic ＜ 2.1.2
nvd cisco nexus insights generic ＜ 6.0.2
nvd cisco optical network controller generic 1.1 · ＜ 1.1.0
nvd cisco packaged contact center enterprise generic ＜ 11.6 · 11.6\(1\)
nvd cisco paging server generic 8.3\(1\) · 8.4\(1\) · 8.5\(1\) · 9.0\(1\) · 9.0\(2\) · 9.1\(1\) · 12.5\(2\) · 14.0\(1\) · ＜ 14.4.1
nvd cisco prime service catalog generic 12.1 · ＜ 12.1
nvd cisco sd-wan vmanage generic 20.3 · ＜ 20.3.4.1 · 20.4 · ≥ 20.4 and ＜ 20.4.2.1 · 20.5 · ≥ 20.5 and ＜ 20.5.1.1 · 20.6 · ≥ 20.6 and ＜ 20.6.2.1 · 20.6.1 · 20.7 · 20.8
nvd cisco secure firewall threat defense generic 6.2.3 · 6.3.0 · 6.4.0 · 6.5.0 · 6.6.0 · 6.7.0 · 7.0.0 · 7.1.0
nvd cisco smart phy generic 3.1.2 · 3.1.3 · 3.1.4 · 3.1.5 · 3.2.1 · ＜ 3.2.1 · 21.3
nvd cisco ucs central generic ＜ 2.0.1
nvd cisco ucs central software generic 2.0 · 2.0\(1a\) · 2.0\(1b\) · 2.0\(1c\) · 2.0\(1d\) · 2.0\(1e\) · 2.0\(1f\) · 2.0\(1g\) · 2.0\(1h\) · 2.0\(1k\) · 2.0\(1l\)
nvd cisco ucs director generic ＜ 6.8.2.0
nvd cisco unified communications manager generic 11.5\(1\) · ＜ 11.5.1 · 11.5\(1\)su3 · 11.5\(1.17900.52\) · 11.5\(1.18119.2\) · 11.5\(1.18900.97\) · 11.5\(1.21900.40\) · 11.5\(1.22900.28\)
nvd cisco unified communications manager im \& presence service generic 11.5\(1\) · 11.5\(1.22900.6\)
nvd cisco unified communications manager im and presence service generic 11.5\(1\) · ＜ 11.5.1
nvd cisco unified computing system generic 006.008\(001.000\)
nvd cisco unified contact center enterprise generic 11.6\(2\) · ＜ 11.6.2 · 12.0\(1\) · 12.5\(1\) · 12.6\(1\) · 12.6\(2\)
nvd cisco unified contact center express generic 12.5\(1\) · ＜ 12.5.1 · 12.5\(1\):su1 · 12.6\(1\) · 12.6\(2\)
nvd cisco unified contact center management portal generic 12.6\(1\)
nvd cisco unified customer voice portal generic 11.6 · ＜ 11.6 · 11.6\(1\) · 12.0 · 12.0\(1\) · 12.5 · 12.5\(1\) · 12.6\(1\)
nvd cisco unified intelligence center generic 12.6\(1\) · ＜ 12.6.1 · 12.6\(1\):es01 · 12.6\(1\):es02 · 12.6\(2\)
nvd cisco unified sip proxy generic 010.000\(000\) · 010.000\(001\) · 010.002\(000\) · 010.002\(001\) · ＜ 10.2.1.2
nvd cisco unified workforce optimization generic ＜ 11.5.1 · 11.5\(1\):sr7
nvd cisco unity connection generic 11.5 · ＜ 11.5.1 · 11.5\(1.10000.6\)
nvd cisco video surveillance manager generic 7.14\(1.26\) · 7.14\(2.26\) · 7.14\(3.025\) · 7.14\(4.018\)
nvd cisco video surveillance operations manager generic ＜ 7.14.4
nvd cisco virtual topology system generic 2.6.6 · ＜ 2.6.7
nvd cisco virtualized infrastructure manager generic ＜ 3.2.0 · ≥ 3.4.0 and ＜ 3.4.4
nvd cisco virtualized voice browser generic ＜ 12.5.1
nvd cisco wan automation engine generic 7.1.3 · 7.2.1 · 7.2.2 · 7.2.3 · 7.3 · ＜ 7.3.0.2 · 7.4 · 7.5 · 7.6
nvd cisco webex meetings server generic 3.0 · ＜ 3.0 · 3.0:maintenance_release1 · 3.0:maintenance_release2 · 3.0:maintenance_release3 · 3.0:maintenance_release3_service_pack_2 · 3.0:maintenance_release3_service_pack_3 · 3.0:maintenance_release3_security_patch4 · 3.0:maintenance_release3_security_patch5 · 3.0:maintenance_release4 · 4.0 · 4.0:maintenance_release1 · 4.0:maintenance_release2 · 4.0:maintenance_release3
nvd cisco workload optimization manager generic ＜ 3.2.1
osv com.guicedee.services log4j-core generic ≤ 1.2.1.2.17
nvd debian debian linux generic 9.0 · 10.0 · 11.0
nvd fedoraproject fedora generic 34 · 35
nvd intel computer vision annotation tool generic any version
nvd intel datacenter manager generic ＜ 5.1
nvd intel genomics kernel library generic any version
nvd intel oneapi sample browser generic any version
nvd intel secure device onboard generic any version
nvd intel system studio generic any version
nvd netapp active iq unified manager generic any version
nvd netapp brocade san navigator generic any version
nvd netapp cloud insights generic any version
nvd netapp cloud manager generic any version
nvd netapp cloud secure agent generic any version
nvd netapp oncommand insight generic any version
nvd netapp ontap tools generic any version
nvd netapp snapcenter generic any version
nvd netapp solidfire \& hci storage node generic any version
nvd netapp solidfire enterprise sds generic any version
osv org.apache.logging.log4j log4j-core generic ≥ 2.0 and ＜ 2.3.1 · ≥ 2.4 and ＜ 2.12.2 · ≥ 2.13.0 and ＜ 2.15.0
osv org.ops4j.pax.logging pax-logging-log4j2 generic ≥ 1.8.0 and ＜ 1.9.2 · ≥ 1.10.0 and ＜ 1.10.8 · ≥ 1.11.0 and ＜ 1.11.10 · ≥ 2.0.0 and ＜ 2.0.11
osv org.xbib.elasticsearch log4j generic any version
nvd percussion rhythmyx generic ≤ 7.3.2
nvd siemens 6bk1602-0aa12-0tp0 firmware generic ＜ 2.7.0
nvd siemens 6bk1602-0aa22-0tp0 firmware generic ＜ 2.7.0
nvd siemens 6bk1602-0aa32-0tp0 firmware generic ＜ 2.7.0
nvd siemens 6bk1602-0aa42-0tp0 firmware generic ＜ 2.7.0
nvd siemens 6bk1602-0aa52-0tp0 firmware generic ＜ 2.7.0
nvd siemens capital generic 2019.1 · ＜ 2019.1 · 2019.1:sp1912
nvd siemens comos generic ＜ 10.4.2
nvd siemens desigo cc advanced reports generic 3.0 · 4.0 · 4.1 · 4.2 · 5.0 · 5.1
nvd siemens desigo cc info center generic 5.0 · 5.1
nvd siemens e-car operation center generic ＜ 2021.12.13
nvd siemens energy engage generic 3.1
nvd siemens energyip generic 8.5 · 8.6 · 8.7 · 9.0
nvd siemens energyip prepay generic ＜ 3.8.0.12
nvd siemens gma-manager generic ＜ 8.6.2.398
nvd siemens head-end system universal device integration system generic any version
nvd siemens industrial edge management generic any version
nvd siemens industrial edge management hub generic ＜ 2021.12.13
nvd siemens logo\! soft comfort generic any version
nvd siemens mendix generic any version
nvd siemens mindsphere generic ＜ 2021.12.16
nvd siemens navigator generic ＜ 2021.12.13
nvd siemens nx generic any version
nvd siemens opcenter intelligence generic ≥ 3.2 and ＜ 3.5
nvd siemens operation scheduler generic ≤ 1.1.3
nvd siemens sentron powermanager generic 4.1 · 4.2
nvd siemens siguard dsa generic ≥ 4.2 and ＜ 4.4.1
nvd siemens sipass integrated generic 2.80 · 2.85
nvd siemens siveillance command generic ≤ 4.16.2.1
nvd siemens siveillance control pro generic any version
nvd siemens siveillance identity generic 1.5 · 1.6
nvd siemens siveillance vantage generic any version
nvd siemens siveillance viewpoint generic any version
nvd siemens solid edge cam pro generic any version
nvd siemens solid edge harness design generic 2020 · ＜ 2020 · 2020:sp2002
nvd siemens spectrum power 4 generic 4.70 · ＜ 4.70 · 4.70:sp7 · 4.70:sp8
nvd siemens spectrum power 7 generic 2.30 · ＜ 2.30 · 2.30:sp2
nvd siemens sppa-t3000 ses3000 firmware generic any version
nvd siemens teamcenter generic any version
nvd siemens vesys generic 2019.1 · ＜ 2019.1 · 2019.1:sp1912 · 2020.1 · 2021.1
nvd siemens xpedition enterprise generic any version
nvd siemens xpedition package integrator generic any version
nvd snowsoftware snow commander generic ＜ 8.10.0
nvd snowsoftware vm access proxy generic ＜ 3.6
nvd sonicwall email security generic ＜ 10.0.13
osv uk.co.nichesolutions.logging.log4j log4j-core generic any version

References

URLTags
https://github.com/apache/logging-log4j2/pull/608 WEB
https://github.com/github/advisory-database/pull/5501 WEB
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf WEB
https://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html WEB
https://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html WEB
https://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html WEB
https://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html WEB
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 WEB
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd WEB
https://seclists.org/fulldisclosure/2022/Dec/2 WEB

Timeline
VulnCheck KEV: earliest evidence2021-12-06Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Published2021-12-10By the CVE Program.
Added to CISA KEV2021-12-10Listed in CISA's Known Exploited Vulnerabilities catalog.
ARMR remediation created2021-12-10Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-08-11NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-12Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.