WaratekVRT Sign in

CVE-2021-45046 Apache Log4j

Affected softwareApache Log4j
Severity9.0 Critical CVSS 3.1 3 scores
Fixed in2.16.0, 2.12.2, 2.3.1
WeaknessExpression language injection (CWE-917)
Published14 Dec 2021
Updated17 Jun 2026

Description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CWE-502 · Deserialization of untrusted data

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2023-05-01 · remediation due 2023-05-22 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 27 citations · 4 exploits · earliest 2021-12-06.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
  • Indexed PoC 10 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2021-12-15.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-45046 in VulnCheck (free account), which lists 22 more citations not shown here.

EvidenceSourceDetailDate
Reported exploitation cisa.gov /news-events/cybersecurity-advisories/aa21-336a 2021-12-06
Reported exploitation cisa.gov /news-events/alerts/2021/12/22/mitigating-log4shell-and-other-log4j-related-vulnerabilities 2021-12-22
Reported exploitation fortinet.com /blog/threat-research/enemybot-a-look-into-keksecs-latest-ddos-botnet 2022-04-12
Reported exploitation pwc.com /gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-annex-download.pdf 2022-04-26
Reported exploitation unit42.paloaltonetworks.com /network-security-trends-cross-site-scripting 2022-05-31
Exploit reference VulnCheck XDB 0c7bc7dc64b4 Exploit type: initial-access 2021-12-15
Exploit reference VulnCheck XDB 73a7e81b7684 Exploit type: info-leak 2021-12-15
Exploit reference VulnCheck XDB be66907d213a Exploit type: infoleak 2021-12-18
Exploit reference VulnCheck XDB e9027127349a Exploit type: initial-access 2025-07-24

5 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Log4j 漏洞本地检测脚本。 Scan all java processes on your host to check whether it's affected by log4j2 remote code execution vulnerability (CVE-2021-45046) 85 2021-12-20
GitHub PoC Log4j 2.15.0 Privilege Escalation -- CVE-2021-45046 22 2021-12-15
GitHub PoC Public testing data. Samples of log4j library versions to help log4j scanners / detectors improve their accuracy for detecting CVE-2021-45046 and CVE-2021-44228. TAG_TESTING, OWNER_KEN, DC_PUBLIC 14 2021-12-16
GitHub PoC Log4Shell / Log4J Payload - CVE-2021-45046 and CVE-2022-42889 8 2025-07-23
GitHub PoC Oh no another one 4 2021-12-15
GitHub PoC Log4Shell(CVE-2021-45046) Sandbox Signature 1 2021-12-24
GitHub PoC ludy-dev/cve-2021-45046 1 2021-12-18
GitHub PoC A simple script to remove Log4J JndiLookup.class from jars in a given directory, to temporarily protect from CVE-2021-45046 and CVE-2021-44228. 2021-12-17
GitHub PoC Replicating CVE-2021-45046 2021-12-15
Nuclei Apache Log4j2 - Remote Code Injection

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2021-45046.armr patch rule, ARMR 2.6 added 2021-12-14 updated 2026-03-04
Sign in to download

How to mitigate CVE-2021-45046

Upgrade Apache Log4j to a release that fixes it: 2.16.0, 2.12.2 or 2.3.1. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.0 CRITICAL v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.0 CRITICAL CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.0 CRITICAL CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 5.1 none AV:N/AC:H/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2026 ↗ CPU 2026-Q2 Oracle Fusion Middleware / Centralized Thirdparty Jars (Apache Log4j) (12.2.1.4.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Enterprise Manager / Load Testing for Web Apps (Apache Log4j) (13.3.0.1)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Enterprise Manager Load Testing for Web Apps (Apache Log4j) 13.3.0.1 13.3.0.1
Oracle Fusion Middleware Centralized Thirdparty Jars (Apache Log4j) 12.2.1.4.0 12.2.1.4.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.logging.log4j:log4j-core 2.13.0 2.16.0 unbounded
org.apache.logging.log4j:log4j-core 2.4.0 2.12.2 unbounded
org.ops4j.pax.logging:pax-logging-log4j2 1.8.0 1.9.2 unbounded
org.ops4j.pax.logging:pax-logging-log4j2 1.10.0 1.10.8 unbounded
org.ops4j.pax.logging:pax-logging-log4j2 1.11.0 1.11.11 unbounded
org.ops4j.pax.logging:pax-logging-log4j2 2.0.0 2.0.12 unbounded
org.apache.logging.log4j:log4j-core 0 2.3.1 unbounded

Products and versions

57 products, 94 version entries
SourceVendorProductSchemeAffected versions
nvd apache log4j generic 2.0 · 2.0:beta9 · 2.0:rc1 · 2.0:rc2 · ≥ 2.0.1 and ＜ 2.12.2 · ≥ 2.13.0 and ＜ 2.16.0
nvd cvat computer vision annotation tool generic any version
nvd debian debian linux generic 10.0 · 11.0
nvd fedoraproject fedora generic 34 · 35
nvd intel audio development kit generic any version
nvd intel datacenter manager generic any version
nvd intel genomics kernel library generic any version
nvd intel oneapi generic any version
nvd intel secure device onboard generic any version
nvd intel sensor solution firmware development kit generic any version
nvd intel system debugger generic any version
nvd intel system studio generic any version
osv org.apache.logging.log4j log4j-core generic ＜ 2.3.1 · ≥ 2.4.0 and ＜ 2.12.2 · ≥ 2.13.0 and ＜ 2.16.0
osv org.ops4j.pax.logging pax-logging-log4j2 generic ≥ 1.8.0 and ＜ 1.9.2 · ≥ 1.10.0 and ＜ 1.10.8 · ≥ 1.11.0 and ＜ 1.11.11 · ≥ 2.0.0 and ＜ 2.0.12
nvd siemens 6bk1602-0aa12-0tp0 firmware generic ＜ 2.7.0
nvd siemens 6bk1602-0aa22-0tp0 firmware generic ＜ 2.7.0
nvd siemens 6bk1602-0aa32-0tp0 firmware generic ＜ 2.7.0
nvd siemens 6bk1602-0aa42-0tp0 firmware generic ＜ 2.7.0
nvd siemens 6bk1602-0aa52-0tp0 firmware generic ＜ 2.7.0
nvd siemens captial generic 2019.1 · ＜ 2019.1 · 2019.1:sp1912
nvd siemens comos generic any version
nvd siemens desigo cc advanced reports generic 4.0 · 4.1 · 4.2 · 5.0 · 5.1
nvd siemens desigo cc info center generic 5.0 · 5.1
nvd siemens e-car operation center generic ＜ 2021.12.13
nvd siemens energy engage generic 3.1
nvd siemens energyip generic 8.5 · 8.6 · 8.7 · 9.0
nvd siemens energyip prepay generic 3.7 · 3.8
nvd siemens gma-manager generic ＜ 8.6.2.398
nvd siemens head-end system universal device integration system generic any version
nvd siemens industrial edge management generic any version
nvd siemens industrial edge management hub generic ＜ 2021.12.13
nvd siemens logo\! soft comfort generic any version
nvd siemens mendix generic any version
nvd siemens mindsphere generic ＜ 2021.12.11
nvd siemens navigator generic ＜ 2021.12.13
nvd siemens nx generic any version
nvd siemens opcenter intelligence generic ≤ 3.2
nvd siemens operation scheduler generic ≤ 1.1.3
nvd siemens sentron powermanager generic 4.1 · 4.2
nvd siemens siguard dsa generic 4.2 · 4.3 · 4.4
nvd siemens sipass integrated generic 2.80 · 2.85
nvd siemens siveillance command generic ≤ 4.16.2.1
nvd siemens siveillance control pro generic any version
nvd siemens siveillance identity generic 1.5 · 1.6
nvd siemens siveillance vantage generic any version
nvd siemens siveillance viewpoint generic any version
nvd siemens solid edge cam pro generic any version
nvd siemens solid edge harness design generic 2020 · ＜ 2020 · 2020:sp2002
nvd siemens spectrum power 4 generic 4.70 · ＜ 4.70 · 4.70:sp7 · 4.70:sp8
nvd siemens spectrum power 7 generic 2.30 · ＜ 2.30 · 2.30:sp2
nvd siemens sppa-t3000 ses3000 firmware generic any version
nvd siemens teamcenter generic any version
nvd siemens tracealertserverplus generic any version
nvd siemens vesys generic 2019.1 · ＜ 2019.1 · 2019.1:sp1912
nvd siemens xpedition enterprise generic any version
nvd siemens xpedition package integrator generic any version
nvd sonicwall email security generic ＜ 10.0.12

References

URLTags
https://www.oracle.com/security-alerts/cpujul2022.html WEB
https://www.oracle.com/security-alerts/cpujan2022.html WEB
https://www.oracle.com/security-alerts/cpuapr2022.html WEB
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html WEB
https://www.openwall.com/lists/oss-security/2021/12/18/1 WEB
https://www.openwall.com/lists/oss-security/2021/12/15/3 WEB
https://www.openwall.com/lists/oss-security/2021/12/14/4 WEB
https://www.kb.cert.org/vuls/id/930724 WEB
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html WEB
https://www.debian.org/security/2021/dsa-5022 WEB

Timeline
VulnCheck KEV: earliest evidence2021-12-06Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Published2021-12-14By the CVE Program.
ARMR remediation created2021-12-14Earliest commit adding this CVE's ARMR patch or security rule.
Added to CISA KEV2023-05-01Listed in CISA's Known Exploited Vulnerabilities catalog.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-06-22Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.