December 10, 2021 · Applied Cybernetics Group
CVE-2021-44228 — Apache Log4j2
known ransomware use
Apache Log4j2 Remote Code Execution Vulnerability
- Added to KEV
2021-12-10- Federal due date
2021-12-24- Vendor
- Apache
- Product
- Log4j2
- EPSS
- 100.0th percentile (score 0.944, as of
2026-06-08) - NVD CVSS v3.1
- —
- Ransomware use
- Known
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
CISA short description
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Required action
For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.