CVE-2018-1285: exploitation status and patch state CVE-2018-1285 · CVSS 9.8 CRITICAL · EPSS 17%
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Is CVE-2018-1285 exploited? Not in the CISA KEV catalog. EPSS puts exploitation in the next 30 days at 17%. Public exploit code: none found in monitored sources. Which products and versions are affected? Apache log4net · Apache log4net up to 2.0.8 fedoraproject · fedora · 30, 31, 32 oracle · application testing suite · 13.3.0.1 oracle · hospitality opera 5 · 5.5, 5.6 oracle · hospitality simphony · 18.2.7.2, 19.1.3 netapp · manageability software development kit netapp · snapcenter Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2018-1285 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-08-28.
CVE-2018-1285: exploitation status and patch state CVE-2018-1285 · CVSS 9.8 CRITICAL · EPSS 17%
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Is CVE-2018-1285 exploited? Not in the CISA KEV catalog. EPSS puts exploitation in the next 30 days at 17%. Public exploit code: none found in monitored sources. Which products and versions are affected? Apache log4net · Apache log4net up to 2.0.8 fedoraproject · fedora · 30, 31, 32 oracle · application testing suite · 13.3.0.1 oracle · hospitality opera 5 · 5.5, 5.6 oracle · hospitality simphony · 18.2.7.2, 19.1.3 netapp · manageability software development kit netapp · snapcenter Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2018-1285 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-08-28.