CVE-2021-44228: listed in the CISA KEV catalog

CVE-2021-44228 · CVSS 10.0 CRITICAL · EPSS 100.0% · KEV 2021-12-10 · patch available

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Is CVE-2021-44228 exploited?

• Listed in the CISA KEV catalog on 2021-12-10.
• Federal remediation due 2021-12-24.
• Past that date by 1771 days.
• Used in ransomware campaigns.
• EPSS puts exploitation in the next 30 days at 100.0%.
• Public exploit code: packaged in a public tool.
• Public detection rules exist.

Which products and versions are affected?

• Apache Software Foundation · Apache Log4j2 · >= 2.0-beta9, < log4j-core* (except the fixed hotfixes listed under "Is there a patch?")
• siemens · 6bk1602-0aa12-0tp0 firmware · < 2.7.0
• siemens · 6bk1602-0aa22-0tp0 firmware · < 2.7.0
• siemens · 6bk1602-0aa32-0tp0 firmware · < 2.7.0
• siemens · 6bk1602-0aa42-0tp0 firmware · < 2.7.0
• siemens · 6bk1602-0aa52-0tp0 firmware · < 2.7.0
• apache · log4j · >= 2.0.1, < 2.3.1, >= 2.4.0, < 2.12.2, >= 2.13.0, < 2.15.0, 2.0
• siemens · sppa-t3000 ses3000 firmware
• siemens · capital · < 2019.1, 2019.1
• siemens · comos · < 10.4.2
• siemens · desigo cc advanced reports · 3.0, 4.0, 4.1, 4.2, 5.0, 5.1
• siemens · desigo cc info center · 5.0, 5.1
• siemens · e-car operation center · < 2021-12-13
• siemens · energy engage · 3.1
• siemens · energyip · 8.5, 8.6, 8.7, 9.0
• siemens · energyip prepay · < 3.8.0.12
• siemens · gma-manager · < 8.6.2j-398
• siemens · head-end system universal device integration system
• siemens · industrial edge management
• siemens · industrial edge management hub · < 2021-12-13

Is there a patch?

Yes. Update to one of these or later:

From Apache Software Foundation's CVE record · Apache Software Foundation advisory

From NVD's analysis

What PlainSec published about CVE-2021-44228

• Patch windows get their own runtime Guard (2026-07-30)

Primary sources

• NVD record
• CISA KEV catalog
• Apache Software Foundation advisory
• Metasploit: exploit/linux/http/mobileiron_core_log4shell
• Metasploit: exploit/multi/http/log4shell_header_injection
• Metasploit: exploit/multi/http/ubiquiti_unifi_log4shell
• Metasploit: exploit/multi/http/vmware_vcenter_log4shell
• Metasploit: auxiliary/scanner/http/log4shell_scanner
• Exploit-DB 51183
• Exploit-DB 50592

KEV and EPSS are re-checked daily. Record last updated 2026-08-16.