Is CVE-2021-44228 being actively exploited?

Yes. CVE-2021-44228 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on December 10, 2021.

What is the CVSS score for CVE-2021-44228?

CVE-2021-44228 has a CVSS 3.1 base score of 10.0 (CRITICAL).

CVE-2021-44228

CRITICAL · CVSS 10.0CISA KEV: actively exploitedEPSS 100.0%EU EUVD: exploited

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Key facts

CVSS score: 10.0 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-20
EPSS score: 100.0% (100th percentile)
In CISA KEV: Yes, added December 10, 2021
In EU EUVD: Yes (EUVD-2021-34768)
Published: December 10, 2021
NVD last modified: August 11, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Apache Log4j2 Remote Code Execution Vulnerability

Added to the KEV catalog on December 10, 2021; federal remediation due December 24, 2021. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2021-34768 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

apache / log4j
apache / log4j
apache / log4j
apache / log4j
apache / log4j
apple / xcode
bentley / synchro
bentley / synchro 4d
cisco / advanced malware protection virtual private cloud appliance
cisco / automated subsea tuning
cisco / automated subsea tuning
cisco / broadworks
cisco / broadworks
cisco / business process automation
cisco / cloud connect
cisco / cloudcenter
cisco / cloudcenter cost optimizer
cisco / cloudcenter suite
cisco / cloudcenter suite
cisco / cloudcenter suite
cisco / cloudcenter suite
cisco / cloudcenter suite
cisco / cloudcenter suite admin
cisco / cloudcenter workload manager
cisco / common services platform collector
cisco / common services platform collector
cisco / common services platform collector
cisco / common services platform collector
cisco / common services platform collector
cisco / common services platform collector
cisco / common services platform collector
cisco / common services platform collector
cisco / connected mobile experiences
cisco / contact center domain manager
cisco / contact center management portal
cisco / crosswork data gateway
cisco / crosswork data gateway
cisco / crosswork network automation
cisco / crosswork network automation
cisco / crosswork network automation
cisco / crosswork network automation
cisco / crosswork network automation
cisco / crosswork network controller
cisco / crosswork network controller
cisco / crosswork optimization engine
cisco / crosswork optimization engine
cisco / crosswork platform infrastructure
cisco / crosswork platform infrastructure
cisco / crosswork zero touch provisioning
cisco / crosswork zero touch provisioning

and 331 more…

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Cisco Intersight Virtual Appliance 1.0.9 with IMM Fabric 4.3 UCS X-Series Servers and UCS C-Series Servers - Cisco Systems, Inc. - Common Criteria NSCIB-CC-2400020-01-CR - active
Cisco Systems, Inc. Intersight Virtual Appliance 1.0.9 with IMM Fabric 4.3 UCS X-Series Servers and UCS C-Series Servers - Cisco Systems, Inc. - Common Criteria NSCIB-CC-2400020-01-CR - active
Cisco ISE v2.0 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-10795-2017 - archived
Cisco Identity Services Engine (ISE) v1.2 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-10521-2014 - archived

References

http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html(Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html(Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html(Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html(Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html(Broken Link, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html(Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
http://seclists.org/fulldisclosure/2022/Dec/2(Exploit, Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2022/Jul/11(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2022/Mar/23(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/12/10/1(Mailing List, Mitigation, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/12/10/2(Mailing List, Mitigation, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/12/10/3(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/12/13/1(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/12/13/2(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/12/14/4(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/12/15/3(Mailing List, Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf(Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf(Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf(Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf(Third Party Advisory)
https://github.com/cisagov/log4j-affected-db(Third Party Advisory)
https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md(Broken Link, Product, US Government Resource)
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228(Exploit, Third Party Advisory)
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html(Mailing List, Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/(Release Notes)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/(Release Notes)
https://logging.apache.org/log4j/2.x/security.html(Release Notes, Vendor Advisory)
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/(Patch, Third Party Advisory, Vendor Advisory)
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032(Third Party Advisory)
https://security.netapp.com/advisory/ntap-20211210-0007/(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain