CVE-2021-45046: Apache Log4j 2.15.0 Incomplete Fix Allows JNDI Lookup Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.0 critical, CISA KEV listed with known ransomware use, and EPSS above 99.9th percentile make this an urgent patch-first issue despite the non-default configuration precondition.

What it is

The fix for CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. When a non-default Pattern Layout uses a Context Lookup (e.g., $${ctx:loginId}) or Thread Context Map pattern (%X, %mdc, %MDC), an attacker who controls that input can inject a JNDI Lookup pattern, causing an information leak and remote code execution in some environments and local code execution in all environments.

Impact

An attacker can leak sensitive information and, in some environments, achieve remote code execution; local code execution is possible in all environments. This can lead to full compromise of the affected application and its host.

Attack surface

Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N), but exploitation requires a non-default logging configuration and attacker control over Thread Context Map input data. The high attack complexity (AC:H) reflects those configuration and input-control preconditions.

Exploitation

CVE-2021-45046 is listed in CISA KEV with known ransomware campaign use, and EPSS shows a 30-day probability of 0.99977 (99.98th percentile). Reference tags include Mitigation, Patch, Vendor Advisory and Third Party Advisory, indicating public mitigation and patch guidance is available.

What to do

• Upgrade to Log4j 2.16.0 (Java 8) or 2.12.2 (Java 7), which remove message lookup patterns and disable JNDI by default.
• If immediate upgrade is not possible, remove JndiLookup from the classpath and disable message lookups per vendor mitigation guidance.
• Audit logging configurations for non-default Pattern Layouts using $${ctx:...}, %X, %mdc or %MDC and remove or restrict them.
• Apply vendor patches for downstream products listed as affected (Apache, Intel, Siemens, Debian, SonicWall, Fedora, CVAT).
• Treat any Thread Context Map input as untrusted and sanitize or reject JNDI-style lookup strings.

Detection

• Search application and WAF logs for JNDI lookup strings such as ${jndi:ldap://, ${jndi:rmi://, ${jndi:dns:// and obfuscated variants in MDC/Thread Context input.
• Monitor for outbound LDAP, RMI or DNS connections from Java application servers to unexpected external hosts.
• Alert on logging configuration changes that introduce $${ctx:...}, %X, %mdc or %MDC patterns.
• Inventory Log4j versions across the estate and flag any 2.15.0 or earlier deployments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.