CVE-2021-44228: listed in the CISA KEV catalog

CVE-2021-44228 · CVSS 10.0 CRITICAL · EPSS 100.0% · KEV 2021-12-10

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Is CVE-2021-44228 exploited?

• Listed in the CISA KEV catalog on 2021-12-10.
• Federal remediation due 2021-12-24.
• Past that date by 1695 days.
• Used in ransomware campaigns.
• EPSS puts exploitation in the next 30 days at 100.0%.
• Public exploit code: packaged in a public tool.
• Public detection rules exist.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2021-44228

• Patch Windows Get Their Own Runtime Guard (2026-07-30)

Primary sources

• NVD record
• CISA KEV catalog
• Metasploit: exploit/linux/http/mobileiron_core_log4shell
• Metasploit: exploit/multi/http/log4shell_header_injection
• Metasploit: exploit/multi/http/ubiquiti_unifi_log4shell
• Metasploit: exploit/multi/http/vmware_vcenter_log4shell
• Metasploit: auxiliary/scanner/http/log4shell_scanner
• Exploit-DB 51183
• Exploit-DB 50592
• Exploit-DB 50590

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.