Back to CVE records
Critical 10.0Known exploited (CISA KEV)Published Dec 10, 2021
CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache Log4j2 and 59 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Dec 10, 2021; federal agencies had to remediate by Dec 24, 2021, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Start free and add your stack
Free account, 1 product
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
- CVSS
- 10.0 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-502, CWE-400, CWE-20
- Known exploited
- Added to CISA KEV Dec 10, 2021; federal remediation due Dec 24, 2021; known ransomware useFor all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
- EPSS (exploitation in the next 30 days)
- 100.00% (percentile 100)
- Assigned by
- apache
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apache Software Foundation Apache Log4j2 apache_software_foundation:apache_log4j2 (from the name) | from 2.0-beta9 before log4j-core*; fixed at 2.3.1, affected at 2.4, fixed at 2.12.2, affected at 2.13.0, fixed at 2.15.0 | CNA record |
siemens 6bk1602-0aa12-0tp0_firmware siemens:6bk1602-0aa12-0tp0_firmware | before 2.7.0 | NVD |
siemens 6bk1602-0aa22-0tp0_firmware siemens:6bk1602-0aa22-0tp0_firmware | before 2.7.0 | NVD |
siemens 6bk1602-0aa32-0tp0_firmware siemens:6bk1602-0aa32-0tp0_firmware | before 2.7.0 | NVD |
siemens 6bk1602-0aa42-0tp0_firmware siemens:6bk1602-0aa42-0tp0_firmware | before 2.7.0 | NVD |
siemens 6bk1602-0aa52-0tp0_firmware siemens:6bk1602-0aa52-0tp0_firmware | before 2.7.0 | NVD |
apache log4j apache:log4j | from 2.0.1 before 2.3.1; from 2.4.0 before 2.12.2; from 2.13.0 before 2.15.0; 2.0; 2.0; 2.0; 2.0 | NVD |
siemens sppa-t3000_ses3000_firmware siemens:sppa-t3000_ses3000_firmware | all versions | NVD |
siemens capital siemens:capital | before 2019.1; 2019.1; 2019.1 | NVD |
siemens comos siemens:comos | before 10.4.2 | NVD |
siemens desigo_cc_advanced_reports siemens:desigo_cc_advanced_reports | 3.0; 4.0; 4.1; 4.2; 5.0; 5.1 | NVD |
siemens desigo_cc_info_center siemens:desigo_cc_info_center | 5.0; 5.1 | NVD |
siemens e-car_operation_center siemens:e-car_operation_center | before 2021-12-13 | NVD |
siemens energy_engage siemens:energy_engage | 3.1 | NVD |
siemens energyip siemens:energyip | 8.5; 8.6; 8.7; 9.0 | NVD |
siemens energyip_prepay siemens:energyip_prepay | before 3.8.0.12 | NVD |
siemens gma-manager siemens:gma-manager | before 8.6.2j-398 | NVD |
siemens head-end_system_universal_device_integration_system siemens:head-end_system_universal_device_integration_system | all versions | NVD |
siemens industrial_edge_management siemens:industrial_edge_management | all versions | NVD |
siemens industrial_edge_management_hub siemens:industrial_edge_management_hub | before 2021-12-13 | NVD |
siemens logo!_soft_comfort siemens:logo!_soft_comfort | all versions | NVD |
siemens mendix siemens:mendix | all versions | NVD |
siemens mindsphere siemens:mindsphere | before 2021-12-16 | NVD |
siemens navigator siemens:navigator | before 2021-12-13 | NVD |
siemens nx siemens:nx | all versions | NVD |
siemens opcenter_intelligence siemens:opcenter_intelligence | from 3.2 before 3.5 | NVD |
siemens operation_scheduler siemens:operation_scheduler | through 1.1.3 | NVD |
siemens sentron_powermanager siemens:sentron_powermanager | 4.1; 4.2 | NVD |
siemens siguard_dsa siemens:siguard_dsa | from 4.2 before 4.4.1 | NVD |
siemens sipass_integrated siemens:sipass_integrated | 2.80; 2.85 | NVD |
siemens siveillance_command siemens:siveillance_command | through 4.16.2.1 | NVD |
siemens siveillance_control_pro siemens:siveillance_control_pro | all versions | NVD |
siemens siveillance_identity siemens:siveillance_identity | 1.5; 1.6 | NVD |
siemens siveillance_vantage siemens:siveillance_vantage | all versions | NVD |
siemens siveillance_viewpoint siemens:siveillance_viewpoint | all versions | NVD |
siemens solid_edge_cam_pro siemens:solid_edge_cam_pro | all versions | NVD |
siemens solid_edge_harness_design siemens:solid_edge_harness_design | before 2020; 2020; 2020; 2020 | NVD |
siemens spectrum_power_4 siemens:spectrum_power_4 | before 4.70; 4.70; 4.70; 4.70 | NVD |
siemens spectrum_power_7 siemens:spectrum_power_7 | before 2.30; 2.30; 2.30; 2.30 | NVD |
siemens teamcenter siemens:teamcenter | all versions | NVD |
siemens vesys siemens:vesys | before 2019.1; 2019.1; 2019.1; 2019.1; 2020.1; 2021.1 | NVD |
siemens xpedition_enterprise siemens:xpedition_enterprise | all versions | NVD |
siemens xpedition_package_integrator siemens:xpedition_package_integrator | all versions | NVD |
intel computer_vision_annotation_tool intel:computer_vision_annotation_tool | all versions | NVD |
intel datacenter_manager intel:datacenter_manager | before 5.1 | NVD |
intel genomics_kernel_library intel:genomics_kernel_library | all versions | NVD |
intel oneapi_sample_browser intel:oneapi_sample_browser | all versions | NVD |
intel secure_device_onboard intel:secure_device_onboard | all versions | NVD |
intel system_studio intel:system_studio | all versions | NVD |
debian debian_linux debian:debian_linux | 9.0; 10.0; 11.0 | NVD |
fedoraproject fedora fedoraproject:fedora | 34; 35 | NVD |
sonicwall email_security sonicwall:email_security | before 10.0.13 | NVD |
netapp active_iq_unified_manager netapp:active_iq_unified_manager | all versions; all versions; all versions | NVD |
netapp brocade_san_navigator netapp:brocade_san_navigator | all versions | NVD |
netapp cloud_insights netapp:cloud_insights | all versions | NVD |
netapp cloud_manager netapp:cloud_manager | all versions | NVD |
netapp cloud_secure_agent netapp:cloud_secure_agent | all versions | NVD |
netapp oncommand_insight netapp:oncommand_insight | all versions | NVD |
netapp ontap_tools netapp:ontap_tools | all versions | NVD |
netapp snapcenter netapp:snapcenter | all versions | NVD |
References
- https://logging.apache.org/log4j/2.x/security.html
- http://www.openwall.com/lists/oss-security/2021/12/10/1mailing-list, mitigation, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/12/10/2mailing-list, mitigation, third-party-advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdvendor-advisory
- http://www.openwall.com/lists/oss-security/2021/12/10/3mailing-list, third-party-advisory
- https://security.netapp.com/advisory/ntap-20211210-0007/
- http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlthird-party-advisory, vdb-entry
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
- https://www.debian.org/security/2021/dsa-5020vendor-advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00007.htmlmailing-list
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/vendor-advisory
- https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/vendor-advisory
- http://www.openwall.com/lists/oss-security/2021/12/13/2mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/12/13/1mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/12/14/4mailing-list, third-party-advisory
- https://www.kb.cert.org/vuls/id/930724third-party-advisory
- https://twitter.com/kurtseifried/status/1469345530182455296
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
- http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.htmlthird-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.htmlexploit, third-party-advisory, vdb-entry
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
- http://www.openwall.com/lists/oss-security/2021/12/15/3mailing-list
- http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.htmlthird-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.htmlthird-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.htmlthird-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.htmlthird-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.htmlbroken-link, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlthird-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.htmlthird-party-advisory, vdb-entry
- http://seclists.org/fulldisclosure/2022/Dec/2exploit, mailing-list, third-party-advisory
- http://seclists.org/fulldisclosure/2022/Jul/11mailing-list, third-party-advisory
- http://seclists.org/fulldisclosure/2022/Mar/23mailing-list, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.