CVE-2021-44228

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalog on 2021-12-10. Federal remediation due 2021-12-24. Known ransomware campaign use: reported by CISA.

SSVC decision

• ExploitationactiveCISA reports credible evidence of active exploitation.
• AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
• Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

99.99% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 100.0% of scored records. A rank, not a probability.

NVD base score

10.0 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD analysis status

Analyzed. NVD last modified this record on 2026-08-11.

Red Hat severity

Critical. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2021-12-10 00:00Z4 YR AGO

Last updated

2025-10-21 23:25Z1 YR AGO

Reserved

2021-11-26

Assigning CNA

apache

Record state

PUBLISHED

Severity

Critical (CVSS 10.0)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

• CWE-20Improper Input ValidationClass
• CWE-400Uncontrolled Resource ConsumptionClass
• CWE-502Deserialization of Untrusted DataBase
• CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')Base

Data version

5.1

Document digest

3339a1f92543f173c820b6037b6cbc4e008723d5ef545be9f073029e871e8d28

• logging.apache.orghttps://logging.apache.org/log4j/2.x/security.html
• www.openwall.com[oss-security] 20211210 CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointshttp://www.openwall.com/lists/oss-security/2021/12/10/1mailing-list
• www.openwall.com[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointshttp://www.openwall.com/lists/oss-security/2021/12/10/2mailing-list
• tools.cisco.com20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdvendor-advisory
• www.openwall.com[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointshttp://www.openwall.com/lists/oss-security/2021/12/10/3mailing-list
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20211210-0007/
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
• psirt.global.sonicwall.comhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
• www.oracle.comhttps://www.oracle.com/security-alerts/alert-cve-2021-44228.html
• www.debian.orgDSA-5020https://www.debian.org/security/2021/dsa-5020vendor-advisory
• lists.debian.org[debian-lts-announce] 20211212 [SECURITY] [DLA 2842-1] apache-log4j2 security updatehttps://lists.debian.org/debian-lts-announce/2021/12/msg00007.htmlmailing-list
• lists.fedoraproject.orgFEDORA-2021-f0f501d01fhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/vendor-advisory
• msrc-blog.microsoft.comMicrosoft’s Response to CVE-2021-44228 Apache Log4j 2https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/vendor-advisory
• www.openwall.com[oss-security] 20211213 Re: CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2http://www.openwall.com/lists/oss-security/2021/12/13/2mailing-list
• www.openwall.com[oss-security] 20211213 CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2http://www.openwall.com/lists/oss-security/2021/12/13/1mailing-list
• www.openwall.com[oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackhttp://www.openwall.com/lists/oss-security/2021/12/14/4mailing-list
• www.kb.cert.orgVU#930724https://www.kb.cert.org/vuls/id/930724third-party-advisory
• twitter.comhttps://twitter.com/kurtseifried/status/1469345530182455296
• cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
• www.intel.comhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
• www.openwall.com[oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackhttp://www.openwall.com/lists/oss-security/2021/12/15/3mailing-list
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
• cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
• lists.fedoraproject.orgFEDORA-2021-66d6c484f3https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/vendor-advisory
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html
• cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
• cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
• www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html
• github.comhttps://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html
• packetstormsecurity.comhttp://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html
• seclists.org20220314 APPLE-SA-2022-03-14-7 Xcode 13.3http://seclists.org/fulldisclosure/2022/Mar/23mailing-list
• www.bentley.comhttps://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001
• github.comhttps://github.com/cisagov/log4j-affected-db
• support.apple.comhttps://support.apple.com/kb/HT213189
• www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.html
• github.comhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228
• www.nu11secur1ty.comhttps://www.nu11secur1ty.com/2021/12/cve-2021-44228.html
• seclists.org20220721 Open-Xchange Security Advisory 2022-07-21http://seclists.org/fulldisclosure/2022/Jul/11mailing-list
• packetstormsecurity.comhttp://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
• packetstormsecurity.comhttp://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html
• seclists.org20221208 Intel Data Center Manager <= 5.1 Local Privileges Escalationhttp://seclists.org/fulldisclosure/2022/Dec/2mailing-list
• packetstormsecurity.comhttp://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html
• www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228government-resource