Security Advisory

CVE-2021-44228 (Log4Shell): Apache Log4j2 RCE explained

Last updated:
  • CVE-2021-44228

CVE-2021-44228 ("Log4Shell") is a critical (CVSS 10.0) remote code execution vulnerability in Apache Log4j2's JNDI lookup feature, triggered when an attacker-controlled string reaches a log message. It affects log4j-core up to 2.14.1, has been in the CISA KEV catalog since 2021-12-10 with known ransomware campaign use, and is fixed in the 2.3.1 and 2.12.2 backports and from 2.15.0 onward.

Vulnerability summary

CVSS base score

10

Critical severity

EPSS score (FIRST)

100.0%

Probability of exploitation in the wild in the next 30 days

CISA KEV catalog

Yes

Listed as known exploited

Published

Vulnerability ID: CVE-2021-44228 · Source: NVD

Affected components

ComponentCPEVersion range
Apache Log4j2 (log4j-core)cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*2.0.1 through 2.3.0 (fixed in 2.3.1)
Apache Log4j2 (log4j-core)cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*2.4.0 through 2.12.1 (fixed in 2.12.2)
Apache Log4j2 (log4j-core)cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*2.13.0 through 2.14.1 (JNDI lookups disabled by default from 2.15.0; removed entirely from 2.16.0)

What does this mean for affected devices?

CVE-2021-44228 ("Log4Shell") affects the JNDI lookup feature in Apache Log4j2's log4j-core component. An attacker who can get a string into a log message or a logged parameter can make Log4j2 resolve a JNDI lookup against an attacker-controlled LDAP or other JNDI endpoint, leading to remote code execution (NVD).

NVD scores it CVSS v3.1 10.0 (critical): network-reachable, low attack complexity, no privileges or user interaction required, and a full compromise of confidentiality, integrity and availability (NVD).

CISA added CVE-2021-44228 to the Known Exploited Vulnerabilities (KEV) catalog on 2021-12-10, the day it was disclosed, and records known use in ransomware campaigns; the required action was to patch or remove affected assets from agency networks (CISA KEV).

NVD lists log4j-core 2.0-beta9 through 2.14.1 as vulnerable by default (JNDI lookups enabled), excluding the backported security releases 2.3.1, 2.12.2 and 2.12.3. From 2.15.0 the risky lookup behaviour is disabled by default, and from 2.16.0 it was removed entirely. The issue is specific to log4j-core and does not affect log4j-api, log4net or log4cxx (NVD).

As of 2026-10-19, FIRST scores the probability of exploitation at the top of the EPSS distribution (EPSS 0.9999, 100th percentile); Log4Shell remains one of the most widely scanned-for vulnerabilities on the internet years after disclosure (FIRST EPSS).

Any application bundling a vulnerable log4j-core release should upgrade to the latest 2.x release; 2.15.0 alone does not remove every related risk, which is why the project continued shipping fixes through 2.17.1.

How to fix this class of issueNo dedicated SoftWSP guide covers this weakness class; the fix is usually the vendor patch or firmware update referenced above. Our related guide explains how to plan and verify it: NIST SP 800-40 Rev. 4: enterprise patch management planning, explained.

Evidence

  • An attacker who controls a logged string can trigger JNDI lookups against an attacker-controlled endpoint, leading to remote code execution. — NVD
  • NVD CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. — NVD
  • Added to the CISA Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware campaign use. — CISA KEV
  • Vulnerable log4j-core versions: 2.0-beta9 through 2.14.1 (JNDI lookups enabled by default); 2.3.1, 2.12.2 and 2.12.3 are fixed backports; 2.15.0 disables the behaviour by default and 2.16.0 removes it entirely. — NVD
  • EPSS score is 0.9999 (100th percentile) as of 2026-10-19. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan reportChat with David on WhatsApp

Related advisories

CVE-2022-1019: Automated Logic WebCTRL Server Open Redirect (Carrier BMS) — CVSS 6.1, Medium severityCVE-2022-1019: the 'Help' index pages on Automated Logic (Carrier) WebCtrl Server through version 7.0 are vulnerable to open redirection via a crafted URL. NVD rates it 6.1 (CVSS v3.1, medium). Sourced to NVD, CISA ICS-CERT scoring and Carrier.CVE-2022-2502: Hitachi Energy RTU500 Series IEC 60870-5-104 Buffer Overflow (Substation RTU Denial of Service) — CVSS 7.5, High severityCVE-2022-2502: a missing input validation flaw in the HCI IEC 60870-5-104 function of Hitachi Energy's RTU500 series substation RTU overflows an internal buffer and reboots the device. NVD rates it 7.5 (CVSS v3.1, high). Sourced to NVD, CISA ICS and Hitachi Energy.CVE-2022-29499: Mitel MiVoice Connect Service Appliance Remote Code Execution (KEV, Actively Exploited) — CVSS 9.8, Critical severityCISA KEVCVE-2022-29499: a remote, unauthenticated attacker can send a specially crafted HTTP GET request to the Service Appliance component of Mitel's MiVoice Connect unified-communications platform (SA 100, SA 400 or Virtual SA) to execute arbitrary OS commands. NVD Primary CVSS 9.8; on the CISA KEV catalog after use in a Lorenz ransomware intrusion.

Sources

  1. NVD
  2. CISA KEV
  3. FIRST EPSS

Frequently asked questions

What is CVE-2021-44228?

CVE-2021-44228 ("Log4Shell") is a critical (CVSS 10.0) remote code execution vulnerability in Apache Log4j2's JNDI lookup feature, triggered when an attacker-controlled string reaches a log message. It affects log4j-core up to 2.14.1, has been in the CISA KEV catalog since 2021-12-10 with known ransomware campaign use, and is fixed in the 2.3.1 and 2.12.2 backports and from 2.15.0 onward.

How severe is CVE-2021-44228?

NVD scores CVE-2021-44228 10 out of 10 on the CVSS scale — a critical severity rating.

Is CVE-2021-44228 being actively exploited?

Yes — CVE-2021-44228 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning CISA has confirmed evidence of active exploitation in the wild.

What is affected by CVE-2021-44228?

CVE-2021-44228 affects Apache Log4j2 (log4j-core), Apache Log4j2 (log4j-core), and Apache Log4j2 (log4j-core).

Where does this CVE-2021-44228 information come from?

This advisory is based on NVD, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp