Skip to content
Fencer Vulns
critical 10.0

CVE-2021-44228 kev+ ransomware in the critical feed json

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

published 2021-12-10 4 y ago modified 2026-08-11 2 mo ago also GHSA-jfh8-c2jp-5v3q , EUVD-2021-34768

cvss
10.0
version 3.1, CNA
cisa kev
Exploited
added 2021-12-10, used in ransomware
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 100%
public exploits
8
Metasploit, Exploit-DB, plus a Nuclei check

Summary

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Patch / fix

cisa required action For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

  • maven org.apache.logging.log4j:log4j-core 2.3.1, 2.12.2, 2.15.0
  • maven org.ops4j.pax.logging:pax-logging-log4j2 1.9.2, 1.10.8, 1.11.10, 2.0.11
  • Apache Software Foundation Apache Log4j2 2.3.1, 2.12.2, 2.15.0
  • apache-log4j2 Debian 14, Debian 13, Debian 12 2.15.0-1

debian advisories DEBIAN-CVE-2021-44228

  • apache-log4j2 Ubuntu 18.04 LTS 2.10.0-2ubuntu0.1
  • apache-log4j2 Ubuntu 20.04 LTS 2.15.0-0.20.04.1
  • apache-log4j2 Ubuntu Pro 16.04 LTS 2.4-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-44228

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-netty jboss enterprise application platform eus 7.3 4.1.63-4.Final_redhat_00002.1.el7eap
  • eap7-wildfly jboss enterprise application platform eus 7.3 7.3.12-3.GA_redhat_00002.1.el7eap
  • eap7-jettison jboss enterprise application platform eus 7.3 1.5.2-2.redhat_00002.1.el7eap
  • eap7-resteasy jboss enterprise application platform eus 7.3 3.11.6-1.Final_redhat_00001.1.el7eap
  • eap7-netty-all jboss enterprise application platform eus 7.3 4.1.63-4.Final_redhat_00002.1.el7eap
  • eap7-snakeyaml jboss enterprise application platform eus 7.3 1.33.0-1.SP1_redhat_00001.1.el7eap
  • eap7-hal-console jboss enterprise application platform eus 7.3 3.2.17-1.Final_redhat_00001.1.el7eap
  • eap7-jackson-core jboss enterprise application platform eus 7.3 2.10.4-2.redhat_00004.1.el7eap

red hat advisories RHSA-2025:1747RHSA-2025:1746

  • storm OpenStack Cloud Crowbar 9, OpenStack Cloud 9 1.2.3-3.5.1
  • venv-openstack-monasca OpenStack Cloud 9 2.7.1~dev10-3.25.1
  • storm OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.2.3-3.8.2
  • venv-openstack-monasca OpenStack Cloud 8, HPE Helion OpenStack 8 2.2.2~dev1-11.32.1

suse advisories SUSE-SU-2021:4097-1SUSE-SU-2021:4096-1

  • log4j openSUSE Tumbleweed 2.13.2-2.1
  • logback openSUSE Leap 15.2 1.2.8-lp152.2.3.2
  • log4j openSUSE Leap 15.2 2.16.0-lp152.3.9.1
  • disruptor openSUSE Leap 15.2 3.4.4-lp152.2.3.1
  • jakarta-servlet openSUSE Leap 15.2 5.0.0-lp152.2.1
  • logback openSUSE Leap 15.3 1.2.8-3.3.1
  • log4j openSUSE Leap 15.3 2.16.0-4.10.1
  • disruptor openSUSE Leap 15.3 3.4.4-3.3.1

opensuse advisories openSUSE-SU-2024:11666-1openSUSE-SU-2021:1613-1openSUSE-SU-2021:1601-1openSUSE-SU-2021:4109-1openSUSE-SU-2021:4107-1openSUSE-SU-2021:4094-1

  • ghidra Arch Linux 10.1-1
  • solr Arch Linux 8.11.0-2
  • openfire Arch Linux 4.6.5-1
  • zaproxy Arch Linux 2.11.1-2
  • mediathekview Arch Linux 13.8.1-1

arch linux advisories AVG-2621AVG-2622AVG-2624AVG-2626AVG-2632

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-44228 updated cvss 9.8

log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

  • Red Hat Integration Camel Quarkus 1 log4j-core Red Hat JBoss Enterprise Application Platform 7 log4j-core
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8 v5.0.10-1
    fixed: vendor fix RHSA-2021:5137
  • Red Hat OpenShift Logging 5.1 openshift-logging/elasticsearch6-rhel8 v6.8.1-67
    fixed: vendor fix RHSA-2021:5128
  • Red Hat OpenShift Logging 5.2 openshift-logging/elasticsearch6-rhel8 v6.8.1-66
    fixed: vendor fix RHSA-2021:5127
  • Red Hat OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8 v6.8.1-65
    fixed: vendor fix RHSA-2021:5129
  • Red Hat AMQ Streams 1.6.5
    fixed: vendor fix RHSA-2021:5133
  • Red Hat AMQ Streams 1.8.4
    fixed: vendor fix RHSA-2021:5138
show 16 more
  • Red Hat Data Grid 8.2.2
    fixed: vendor fix RHSA-2021:5132
  • Red Hat Fuse 7.8.2, 7.9.1, 7.10.1
    fixed: vendor fix RHSA-2022:0203
  • Red Hat Fuse 7.10
    fixed: vendor fix RHSA-2021:5134
  • Red Hat Integration
    fixed: vendor fix RHSA-2021:5130
  • Red Hat Integration Camel Quarkus 2
    fixed: vendor fix RHSA-2021:5126
  • Red Hat JBoss Enterprise Application Platform log4j-api 2.17.1.redhat-00002
    fixed: vendor fix RHSA-2021:5140
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jettison 1.3.8-2.redhat_00002.1.ep7.el7, eap7-velocity 1.7.0-3.redhat_00006.1.ep7.el7, eap7-wildfly 7.1.9-2.GA_redhat_00002.1.ep7.el7, eap7-apache-cxf 3.1.16-4.redhat_00003.1.ep7.el7, eap7-netty 4.1.63-1.Final_redhat_00002.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-4.redhat_00003.1.ep7.el7, +23 more
    fixed: vendor fix RHSA-2025:1746
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jettison 1.5.2-2.redhat_00002.1.el7eap, eap7-wildfly 7.3.12-3.GA_redhat_00002.1.el7eap, eap7-netty 4.1.63-4.Final_redhat_00002.1.el7eap, eap7-jackson-core 2.10.4-2.redhat_00004.1.el7eap, eap7-snakeyaml 1.33.0-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.11.6-1.Final_redhat_00001.1.el7eap, +35 more
    fixed: vendor fix RHSA-2025:1747
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5 v3.11.570-2.gd119820
    fixed: vendor fix RHSA-2021:5094
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-metering-hive v4.6.0-202112140546.p0.g8b9da97.assembly.stream, openshift4/ose-metering-presto v4.6.0-202112150545.p0.g190688a.assembly.art3595, openshift4/ose-logging-elasticsearch6 v4.6.0-202112132021.p0.g2a13a81.assembly.stream
    fixed: vendor fix RHSA-2021:5106
  • Red Hat OpenShift Container Platform 4.7 openshift4/ose-metering-hive v4.7.0-202112140553.p0.g091bb99.assembly.stream, openshift4/ose-metering-presto v4.7.0-202112150631.p0.gd502108.assembly.4.7.40
    fixed: vendor fix RHSA-2021:5107
  • Red Hat OpenShift Container Platform 4.8 openshift4/ose-metering-hive v4.8.0-202112132154.p0.g57dd03a.assembly.stream, openshift4/ose-metering-presto v4.8.0-202112150431.p0.g4b934ae.assembly.art3599
    fixed: vendor fix RHSA-2021:5108
  • Red Hat RHPAM 7.11.1
    fixed: vendor fix RHSA-2022:0082
  • Red Hat RHPAM 7.12.0
    fixed: vendor fix RHSA-2022:0296
  • Red Hat Vert.x 4.1.5 SP1
    fixed: vendor fix RHSA-2021:5093
  • Red Hat A-MQ Clients 2 log4j-core Red Hat OpenShift Logging 5.0 openshift-logging/fluentd-rhel8 v5.0.10-1, openshift-logging/kibana6-rhel8 v5.0.10-1, openshift-logging/eventrouter-rhel8 v5.0.10-1, openshift-logging/logging-curator5-rhel8 v5.0.10-1, openshift-logging/elasticsearch-proxy-rhel8 v5.0.10-1, openshift-logging/elasticsearch-rhel8-operator v5.0.10-1, +3 more Red Hat OpenShift Logging 5.1 openshift-logging/fluentd-rhel8 v1.7.4-72, openshift-logging/kibana6-rhel8 v6.8.1-75, openshift-logging/eventrouter-rhel8 v0.3.0-65, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-68, openshift-logging/elasticsearch-rhel8-operator v5.1.5-3, openshift-logging/cluster-logging-rhel8-operator v5.1.5-3, +2 more Red Hat OpenShift Logging 5.2 openshift-logging/fluentd-rhel8 v1.7.4-71, openshift-logging/kibana6-rhel8 v6.8.1-74, openshift-logging/eventrouter-rhel8 v0.3.0-64, openshift-logging/logging-curator5-rhel8 v5.8.1-47, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-67, openshift-logging/elasticsearch-rhel8-operator v5.2.4-4, +4 more Red Hat OpenShift Logging 5.3 openshift-logging/fluentd-rhel8 v1.7.4-70, openshift-logging/kibana6-rhel8 v6.8.1-73, openshift-logging/eventrouter-rhel8 v0.3.0-63, openshift-logging/logging-curator5-rhel8 v5.8.1-46, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-66, openshift-logging/elasticsearch-rhel8-operator v5.3.1-3, +4 more Red Hat 3scale API Management Platform 2 log4j
    +10 more products
    Red Hat AMQ Broker 7 log4j Red Hat build of Quarkus log4j-core Red Hat Decision Manager 7 log4j-core Red Hat Enterprise Linux 6 log4j, log4j-manual, log4j-javadoc Red Hat Enterprise Linux 7 log4j, log4j-manual, log4j-javadoc Red Hat Enterprise Linux 8 log4j12, log4j12-javadoc Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1482 more Red Hat JBoss Enterprise Application Platform 6 log4j Red Hat JBoss Enterprise Application Platform Expansion Pack log4j-core Red Hat OpenShift Container Platform 4.6 openshift4/ose-metering-hadoop v4.6.0-202112150545.p0.gf381145.assembly.art3595, openshift4/ose-elasticsearch-operator v4.6.0-202112140939.p0.gd421c69.assembly.art3594, openshift4/ose-metering-ansible-operator v4.6.0-202112140831.p0.gd74112d.assembly.art3594, openshift4/ose-metering-ansible-operator v4.6.0-202112150545.p0.gd74112d.assembly.art3595, openshift4/ose-elasticsearch-operator-bundle v4.6.0.202112140939.p0.gd421c69.assembly.art3594-1, openshift4/ose-metering-ansible-operator-bundle v4.6.0.202112140831.p0.gd74112d.assembly.art3594-1, +1 more
    not affected: vulnerable code not present

7 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-034-01 updated cvss 10.0

Sensormatic PowerManage (Update A)

  • Sensormatic Electronics, LLC, Johnson Controls Inc. PowerManage >= 4.0, <= 4.8
    affected: fixed in 4.10, mitigation “For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2022-01 v1” johnsoncontrols.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-21-357-02 updated cvss 10.0

Johnson Controls exacq Enterprise Manager

  • Exacq Technologies, Johnson Controls Inc. Exacq Enterprise Manager <= 21.12
    affected: mitigation “Johnson Controls recommends upgrading exacq Enterprise Manager to Version 21.12.1 or apply manual mitigation steps (available upon request).” exacq.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. First public exploit (Metasploit auxiliary/scanner/http/log4shell_scanner)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2021-12-24 (4 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Vendor, product
Apache, Log4j2
CISA name
Apache Log4j2 Remote Code Execution Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

  • LockBit ransomware gang
  • Prophet Spider initial access broker
  • AvosLocker ransomware gang
  • DragonForce ransomware gang

reported by cisa.govsecureworks.comblog.talosintelligence.comtrendmicro.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1190 Exploit Public-Facing Application exploitation
  • T1486 Data Encrypted for Impact secondary impact
  • T1496 Resource Hijacking secondary impact
  • T1505.003 Web Shell secondary impact
  • T1608.001 Upload Malware secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

100.00% chance of exploitation in the next 30 days, higher than 100% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/linux/http/mobileiron_core_log4shell MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell) metasploit exploit, excellent rank, 2021-12-12
  • Metasploit auxiliary/scanner/http/log4shell_scanner Log4Shell HTTP Scanner metasploit auxiliary, normal rank, 2021-12-09
  • Metasploit exploit/multi/http/log4shell_header_injection Log4Shell HTTP Header Injection metasploit exploit, excellent rank, 2021-12-09
  • Metasploit exploit/multi/http/ubiquiti_unifi_log4shell UniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell) metasploit exploit, excellent rank, 2021-12-09
  • Metasploit exploit/multi/http/vmware_vcenter_log4shell VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell) metasploit exploit, excellent rank, 2021-12-09
  • EDB-51183 AD Manager Plus 7122 - Remote Code Execution (RCE) remote, 2023-04-01
  • EDB-50592 Apache Log4j 2 - Remote Code Execution (RCE) remote, 2021-12-14
  • EDB-50590 Apache Log4j2 2.14.1 - Information Disclosure remote, 2021-12-14
  • Nuclei template Apache Log4j2 Remote Code Injection nuclei detection template
  • twitter.com https://twitter.com/kurtseifried/status/1469345530182455296 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
  • nu11secur1ty.com https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2022/Dec/2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C
GitHub 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H

Affected packages

ecosystem package affected fixed in
maven org.apache.logging.log4j:log4j-core
>=2.13.0, <2.15.0
>=2.0-beta9, <2.3.1
>=2.4, <2.12.2
2.15.0
2.3.1
2.12.2
maven com.guicedee.services:log4j-core
<=1.2.1.2-jre17
 no fix listed
maven org.xbib.elasticsearch:log4j
1 listed version
 no fix listed
maven uk.co.nichesolutions.logging.log4j:log4j-core
1 listed version
 no fix listed
maven org.ops4j.pax.logging:pax-logging-log4j2
>=1.8.0, <1.9.2
>=1.10.0, <1.10.8
>=1.11.0, <1.11.10
>=2.0.0, <2.0.11
1.9.2
1.10.8
1.11.10
2.0.11

Affected products

  • Apache Software Foundation Apache Log4j2

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-20 Improper Input Validation
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.