Role
Vulnerability and exposure management
Fix what attackers can reach first: see internet-facing exposure and the flaws being exploited, instead of a long scanner list.
Read more
Exploited vulnerability
Log4Shell
CVE-2021-44228
Log4Shell (CVE-2021-44228) is a remote code execution flaw in Log4j 2, a widely used Java logging library from the Apache Software Foundation.
- On CISA KEV
- CVE ID
- CVE-2021-44228
- CISA KEV
- Listed
- Affected product
- Log4j 2
- Exploited
- Yes
- Published
- December 2021
In short
Log4Shell (CVE-2021-44228) is a remote code execution flaw in Log4j 2, a widely used Java logging library from the Apache Software Foundation. It was published on 10 December 2021, scored 10.0 (critical) by NVD, and CISA, citing public reporting, says exploitation began on or around 1 December 2021. It sits in CISA's Known Exploited Vulnerabilities catalog.
- CVECVE-2021-44228
- ProductApache Software Foundation Log4j 2
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps6actions listedUpdate Log4j · Find where it is embedded
What it allows
An attacker who can control log messages or log message parameters can make the server load and run code from an LDAP server the attacker controls. The mechanism is a JNDI lookup that Log4j performs on text it logs. CISA says an attacker could use it to take control of an affected system, and NVD rates it 10.0 with network access, low complexity, no privileges and no user interaction needed.
Who is affected
Log4j 2 versions from 2.0-beta9 up to the 2.14.1 release are named by CISA and the UK NCSC. NVD lists 2.0-beta9 through 2.15.0, excluding the security releases 2.12.2, 2.12.3 and 2.3.1. Apache's first fixes were 2.15.0 (Java 8 and later), 2.12.2 (Java 7) and 2.3.1 (Java 6).
That first fix was not complete. Apache and the NCSC list two follow-up flaws, CVE-2021-45046 and CVE-2021-45105, so CISA's later guidance points to Log4j 2.17.1 (Java 8), 2.12.4 (Java 7) and 2.3.2 (Java 6).
Log4j is used in consumer and enterprise services, websites, applications and operational technology products, often as a bundled dependency, so many organizations ran it without knowing. CISA, citing public reporting, says exploitation began on or around 1 December 2021 and a public proof of concept was available. NVD shows the CISA KEV entry was added on 10 December 2021, with a federal due date of 24 December 2021. The FBI observed widespread scanning and attempts to deploy cryptomining and botnet malware.
Who exploits it
What to do
-
Update Log4j
Move to a fixed release. CISA's guidance names Log4j 2.17.1 (Java 8), 2.12.4 (Java 7) and 2.3.2 (Java 6). The first fix, 2.15.0, was later found incomplete.
-
Find where it is embedded
Log4j is often bundled inside other products. CISA says to account for it in all assets, including internally developed software and systems not facing the internet. List the applications that include it.
-
Prioritize exposed systems
CISA advises patching mission critical, internet-facing and networked servers first.
-
Mitigate if you cannot update
The NCSC says that if updates are unavailable, removing the JndiLookup class from the classpath mitigates the flaw.
-
Hunt for compromise
CISA advises assuming that assets using Log4j may have been compromised and starting hunt procedures. The NCSC suggests watching for internally initiated LDAP, LDAPS, RMI and DNS connections to external destinations not seen before 10 December 2021.
-
Follow the KEV required action
The catalog entry says to apply updates, or remove affected assets from agency networks.
Questions
What is Log4Shell?
Log4Shell is the name for CVE-2021-44228, a remote code execution flaw in Log4j 2, a widely used Java logging library. It was published on 10 December 2021 and has been exploited in real attacks.
How does Log4Shell work?
An attacker who can control log messages or their parameters can make the server load and run code from an LDAP server the attacker controls. The mechanism is a JNDI lookup.
Who is affected by Log4Shell?
Organizations that run applications or products with a vulnerable version of Log4j 2. Log4j is often bundled inside other products, so teams need to list the applications that include it.
Which Log4j versions fix it?
Apache's first fixes were 2.15.0, 2.12.2 and 2.3.1, but they were incomplete. CISA's later guidance names 2.17.1 for Java 8, 2.12.4 for Java 7 and 2.3.2 for Java 6.
How do I defend against Log4Shell?
Move to a fixed release of Log4j 2 and find where it is embedded in other products. If you cannot update, the NCSC says removing the JndiLookup class mitigates it. Also hunt for compromise and watch for unusual outbound connections from servers that run Java.
When was Log4Shell first exploited?
CISA, citing public reporting, says exploitation began on or around 1 December 2021, before the public disclosure on 10 December 2021.
In our research
- A New Linux Backdoor Detected to Deployed with Log4Shell Vulnerabilities March 2022
- React2Shell — The Day 5 Reality Check December 2025
- DragonForce Ransomware: From Hacktivism to High-Street Extortion September 2025
- Vulnerability and Malware Trends of 2022 January 2023
- The Most Affected Products by Vulnerabilities October 2022
- What Should You Know About Ransomware September 2022
Sources
- CVE-2021-44228 detail NIST National Vulnerability Database
- Apache Log4j Vulnerability Guidance CISA
- Apache Log4j Vulnerability Guidance (AA21-356A) CISA
- Log4j vulnerabilities UK NCSC
- Apache Log4j security vulnerabilities Apache Software Foundation (vendor advisory)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.