CVE-2021-44832: Apache Log4j2 JDBC Appender JNDI LDAP Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityAlthough CVSS is medium (6.6) and exploitation requires high privileges and attacker control of an LDAP server, the very high EPSS score and the severity of RCE in a ubiquitous logging library warrant high priority.

What it is

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding 2.3.2 and 2.12.4) allow remote code execution when a configuration uses a JDBC Appender with a JNDI LDAP data source URI and the attacker controls the target LDAP server. The flaw is improper input validation of JNDI data source names, fixed by restricting them to the java protocol in 2.17.1, 2.12.4 and 2.3.2. It matters because it is another JNDI-based RCE path in the widely deployed Log4j2 library.

Impact

An attacker who controls the referenced LDAP server can return a malicious JNDI reference and achieve remote code execution in the context of the Log4j2 process. This gives full compromise of the application's confidentiality, integrity and availability.

Attack surface

Reachable over the network (AV:N) but requires high attack complexity (AC:H) and high privileges (PR:H), with no user interaction (UI:N). The attacker must already control the LDAP server named in the JDBC Appender's JNDI data source URI, so exploitation depends on a specific non-default configuration and prior control of that server.

Exploitation

Not listed in CISA KEV and no ransomware groups are documented using it, but EPSS is very high (0.97906, 99.9th percentile), indicating strong predicted exploitation activity. References include vendor patch and advisory tags from Apache, Oracle, Cisco, Debian, Fedora and Siemens.

What to do

• Upgrade Log4j2 to 2.17.1, 2.12.4 or 2.3.2, which limit JNDI data source names to the java protocol.
• If immediate upgrade is not possible, remove or disable JDBC Appenders that use JNDI LDAP data source URIs.
• Restrict outbound LDAP traffic from application servers to only trusted, required destinations.
• Audit Log4j2 configurations for JDBC Appender entries referencing ldap:// or other non-java JNDI URIs.
• Apply vendor patches for downstream products (Oracle, Cisco, Debian, Fedora, Siemens) that bundle affected Log4j2 versions.

Detection

• Search Log4j2 configuration files for JDBC Appender definitions containing JNDI data source URIs with ldap:// or non-java protocols.
• Monitor application server outbound LDAP connections, especially to unexpected or external hosts.
• Alert on JNDI lookup activity from Java processes that correlates with Log4j2 logging events.
• Inventory Log4j2 versions across applications and flag any in the 2.0-beta7 to 2.17.0 range excluding 2.3.2 and 2.12.4.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.