kbrain

CVE-2017-5645

CRITICAL · CVSS 9.8EPSS 89.8%EU EUVD

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Key facts

CVSS score
9.8 (v3.1)
Severity
CRITICAL
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-502
EPSS score
89.8% (100th percentile)
In CISA KEV
No
In EU EUVD
Yes (EUVD-2020-0263)
Published
April 17, 2017
NVD last modified
October 8, 2026
Status
Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2020-0263 in the EU Vulnerability Database. Last updated in EUVD on October 8, 2026.

View on the EU Vulnerability Database

Affected products

  • apache / log4j
  • netapp / oncommand api services
  • netapp / oncommand insight
  • netapp / oncommand workflow automation
  • netapp / service level manager
  • netapp / snapcenter
  • netapp / storage automation store
  • oracle / api gateway
  • oracle / application testing suite
  • oracle / autovue vuelink integration
  • oracle / autovue vuelink integration
  • oracle / banking platform
  • oracle / banking platform
  • oracle / banking platform
  • oracle / bi publisher
  • oracle / bi publisher
  • oracle / bi publisher
  • oracle / bi publisher
  • oracle / communications converged application server - service controller
  • oracle / communications instant messaging server
  • oracle / communications interactive session recorder
  • oracle / communications messaging server
  • oracle / communications network integrity
  • oracle / communications online mediation controller
  • oracle / communications pricing design center
  • oracle / communications pricing design center
  • oracle / communications service broker
  • oracle / communications webrtc session controller
  • oracle / configuration manager
  • oracle / configuration manager
  • oracle / endeca information discovery studio
  • oracle / enterprise data quality
  • oracle / enterprise manager base platform
  • oracle / enterprise manager base platform
  • oracle / enterprise manager for fusion middleware
  • oracle / enterprise manager for fusion middleware
  • oracle / enterprise manager for mysql database
  • oracle / enterprise manager for oracle database
  • oracle / enterprise manager for oracle database
  • oracle / enterprise manager for peoplesoft
  • oracle / enterprise manager for peoplesoft
  • oracle / financial services analytical applications infrastructure
  • oracle / financial services behavior detection platform
  • oracle / financial services behavior detection platform
  • oracle / financial services hedge management and ifrs valuations
  • oracle / financial services hedge management and ifrs valuations
  • oracle / financial services lending and leasing
  • oracle / financial services lending and leasing
  • oracle / financial services loan loss forecasting and provisioning
  • oracle / financial services loan loss forecasting and provisioning

and 120 more…

Certified products that may be affected

8 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

See all 8 in the Security Certifications Explorer.

References

Last updated October 10, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain
CVE-2017-5645: CRITICAL severity (CVSS 9.8)