CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: yes — in CISA KEV since 2021-12-10
EPSS: 100.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-10 · updated 2026-08-11
Weakness: CWE-20

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Summary

CVE-2021-44228 is a critical remote code execution flaw in Apache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, and 2.3.1) where JNDI features do not protect against attacker-controlled endpoints, allowing arbitrary code execution via log messages. It is actively exploited, listed in CISA KEV, and has a public exploit with 100% EPSS probability. Affected products include Apache Log4j and various third-party applications like Apple Xcode, Bentley Synchro, and Cisco products. Apply updates to fixed versions (e.g., Log4j 2.15.0, 2.12.2, 2.3.1, or later) or remove affected assets; temporary mitigations are only acceptable until updates are available.

CVE-2021-44228 هو ثغرة تنفيذ تعليمات برمجية عن بُعد خطيرة في Apache Log4j2 الإصدارات من 2.0-beta9 إلى 2.15.0 (باستثناء 2.12.2 و2.12.3 و2.3.1) حيث لا تحمي ميزات JNDI من نقاط النهاية التي يتحكم بها المهاجم، مما يسمح بتنفيذ تعليمات برمجية عشوائية عبر رسائل السجل. الثغرة مستغلة بنشاط، ومدرجة في CISA KEV، ولها استغلال عام مع احتمال 100% وفق EPSS. تشمل المنتجات المتأثرة Apache Log4j وتطبيقات طرف ثالث مثل Apple Xcode وBentley Synchro ومنتجات Cisco. قم بتطبيق التحديثات للإصدارات المُصلحة (مثل Log4j 2.15.0 أو 2.12.2 أو 2.3.1 أو أحدث) أو إزالة الأصول المتأثرة؛ التخفيفات المؤقتة مقبولة فقط حتى توفر التحديثات.

Affected products

Apache Log4j: from 2.0.1 before 2.3.1; from 2.4.0 before 2.12.2; from 2.13.0 before 2.15.0; 2.0, 2.0-beta9, 2.0-rc1, 2.0-rc2 — fixed in 2.12.2, 2.15.0, 2.3.1
Apple Xcode: before 13.3 — fixed in 13.3
Bentley Synchro: from 6.1 before 6.2.4.2 — fixed in 6.2.4.2
Bentley Synchro 4D: before 6.4.3.2 — fixed in 6.4.3.2
Cisco Advanced Malware Protection Virtual Private Cloud Appliance: before 3.5.4 — fixed in 3.5.4
Cisco Automated Subsea Tuning: before 2.1.0; 02.01.00 — fixed in 2.1.0
Cisco Broadworks: before 2021.11_1.162 — fixed in 2021.11_1.162
Cisco Business Process Automation (BPA): before 3.0.000.115; from 3.1.000.000 before 3.1.000.044; from 3.2.000.000 before 3.2.000.009 — fixed in 3.0.000.115, 3.1.000.044, 3.2.000.009
Cisco Cloud Connect: before 12.6\(1\) — fixed in 12.6\(1\)
Cisco Cloudcenter: before 4.10.0.16 — fixed in 4.10.0.16
Cisco Cloudcenter Cost Optimizer: before 5.5.2 — fixed in 5.5.2
Cisco Cloudcenter Suite: 4.10.0.15, 5.3.0, 5.4.1, 5.5.0, 5.5.1
Cisco Cloudcenter Suite Admin: before 5.3.1 — fixed in 5.3.1
Cisco Cloudcenter Workload Manager: before 5.5.2 — fixed in 5.5.2
Cisco Common Services Platform Collector Software: before 2.9.1.3; from 2.10.0 before 2.10.0.1; 002.009(000.000), 002.009(000.001), 002.009(000.002), 002.009(001.000), 002.009(001.001), 002.009(001.002) (+1) — fixed in 2.10.0.1, 2.9.1.3
Cisco Connected Mobile Experiences: all versions
Cisco Contact Center Domain Manager: before 12.5\(1\) — fixed in 12.5\(1\)
Cisco Contact Center Management Portal: before 12.5\(1\) — fixed in 12.5\(1\)
Cisco Crosswork Data Gateway: before 2.0.2; 3.0.0 — fixed in 2.0.2
Cisco Crosswork Network Automation: 2.0.0, 3.0.0, 4.1.0, 4.1.1
Cisco Crosswork Network Change Automation: before 2.0.1; 3.0.0 — fixed in 2.0.1
Cisco Crosswork Optimization Engine: before 2.0.1; 3.0.0 — fixed in 2.0.1
Cisco Crosswork Platform Infrastructure: before 4.0.1; 4.1.0 — fixed in 4.0.1
Cisco Crosswork Zero Touch Provisioning: before 2.0.1; 3.0.0 — fixed in 2.0.1
Cisco Customer Experience Cloud Agent: before 1.12.1 — fixed in 1.12.1
Cisco CX Cloud Agent: 001.012
Cisco Cyber Vision: 4.0.2
Cisco Cyber Vision Sensor Management Extension: before 4.0.3; 4.0.2 — fixed in 4.0.3
Cisco Data Center Network Manager: before 11.3\(1\); 11.3(1) — fixed in 11.3\(1\)
Cisco Dna Center: before 2.1.2.8; from 2.2.2.0 before 2.2.2.8; from 2.2.3.0 before 2.2.3.4; 2.2.2.8 — fixed in 2.1.2.8, 2.2.2.8, 2.2.3.4

How to fix

Upgrade to a fixed version: Apache Log4j 2.12.2, 2.15.0, 2.3.1; Apple Xcode 13.3; Bentley Synchro 6.2.4.2; Bentley Synchro 4D 6.4.3.2; Cisco Advanced Malware Protection Virtual Private Cloud Appliance 3.5.4; Cisco Automated Subsea Tuning 2.1.0; Cisco Broadworks 2021.11_1.162; Cisco Business Process Automation (BPA) 3.0.000.115, 3.1.000.044, 3.2.000.009; Cisco Cloud Connect 12.6\(1\); Cisco Cloudcenter 4.10.0.16; Cisco Cloudcenter Cost Optimizer 5.5.2; Cisco Cloudcenter Suite Admin 5.3.1. Check the vendor advisory for mitigations.

In the news

php2shell one week later: Why one exploit doesn’t work everywhere

References

Get alerted when CVE-2021-44228 or the next vulnerability affects your stack