CVE-2021-44228: Apache Log4j2 JNDI lookup remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 10.0, unauthenticated network RCE, CISA KEV active exploitation with ransomware use, and EPSS at the 100th percentile make this an emergency patch.

What it is

Apache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, and 2.3.1) do not protect against attacker-controlled LDAP and other JNDI endpoints when message lookup substitution is enabled. An attacker who controls log messages or log message parameters can cause arbitrary code to be loaded from a remote server. This is a critical, network-reachable flaw in a widely embedded logging library.

Impact

An unauthenticated attacker can execute arbitrary code in the context of the application using Log4j2, leading to full host compromise. Because the library is embedded in many products, the blast radius extends across the listed vendor and product set.

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N); any input path that reaches a Log4j2 log message or parameter, such as HTTP headers, can carry the malicious JNDI string. No authentication is required.

Exploitation

CISA KEV lists it as actively exploited with a 2021-12-24 remediation due date and known ransomware campaign use; EPSS is 0.99999 (100th percentile) and multiple references are tagged Exploit.

What to do

• Upgrade log4j-core to 2.16.0 or later, or to the fixed 2.12.2, 2.12.3, or 2.3.1 security releases for older branches.
• If immediate upgrade is not possible, remove the JndiLookup class from the classpath or set log4j2.formatMsgNoLookups=true, and apply the CISA ED-22-02 mitigation measures.
• Inventory all applications and third-party products that bundle log4j-core, including the listed vendor products, and treat any unpatched instance as exposed.
• Remove or isolate affected assets from the network until updates can be applied, per CISA required action.
• Block outbound LDAP, RMI, and other JNDI-related traffic from application servers to untrusted destinations.

Detection

• Search logs and network traffic for JNDI lookup strings such as ${jndi:ldap://, ${jndi:rmi://, and obfuscated variants in HTTP headers, parameters, and user-agent fields.
• Monitor for outbound LDAP/RMI connections from application servers to unexpected external hosts.
• Alert on child processes spawned by Java application servers, especially shell or download utilities.
• Scan hosts and containers for log4j-core JARs in the affected version range and verify the JndiLookup class is absent or lookups are disabled.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.