CVE-2021-44228 (Log4Shell): Apache Log4j2 RCE explained

CVE-2021-44228 ("Log4Shell") is a critical (CVSS 10.0) remote code execution vulnerability in Apache Log4j2's JNDI lookup feature, triggered when an attacker-controlled string reaches a log message.

CVE-2021-44228 ("Log4Shell") affects the JNDI lookup feature in Apache Log4j2's log4j-core component. An attacker who can get a string into a log message or a logged parameter can make Log4j2 resolve a JNDI lookup against an attacker-controlled LDAP or other JNDI endpoint, leading to remote code execution (NVD).

NVD scores it CVSS v3.1 10.0 (critical): network-reachable, low attack complexity, no privileges or user interaction required, and a full compromise of confidentiality, integrity and availability (NVD).

CISA added CVE-2021-44228 to the Known Exploited Vulnerabilities (KEV) catalog on 2021-12-10, the day it was disclosed, and records known use in ransomware campaigns; the required action was to patch or remove affected assets from agency networks (CISA KEV).

NVD lists log4j-core 2.0-beta9 through 2.14.1 as vulnerable by default (JNDI lookups enabled), excluding the backported security releases 2.3.1, 2.12.2 and 2.12.3. From 2.15.0 the risky lookup behaviour is disabled by default, and from 2.16.0 it was removed entirely. The issue is specific to log4j-core and does not affect log4j-api, log4net or log4cxx (NVD).

As of 2026-10-19, FIRST scores the probability of exploitation at the top of the EPSS distribution (EPSS 0.9999, 100th percentile); Log4Shell remains one of the most widely scanned-for vulnerabilities on the internet years after disclosure (FIRST EPSS).

Any application bundling a vulnerable log4j-core release should upgrade to the latest 2.x release; 2.15.0 alone does not remove every related risk, which is why the project continued shipping fixes through 2.17.1.

• An attacker who controls a logged string can trigger JNDI lookups against an attacker-controlled endpoint, leading to remote code execution. — NVD
• NVD CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware campaign use. — CISA KEV
• Vulnerable log4j-core versions: 2.0-beta9 through 2.14.1 (JNDI lookups enabled by default); 2.3.1, 2.12.2 and 2.12.3 are fixed backports; 2.15.0 disables the behaviour by default and 2.16.0 removes it entirely. — NVD
• EPSS score is 0.9999 (100th percentile) as of 2026-10-19. — FIRST EPSS