VulnRadar

Data against noise.

Built with NaN
Page generated: 06 Nov 2026, 03:51 UTC
← Dashboard

CVE-2021-44228

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messa…

Read full description
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
1.9/10
REALITY · THREAT PRIORITY
9.4/10
General review priority; not probability

Evidence confidence: Campaign documented

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 10: +1.50
  • Fresh EPSS: 100.00%: +0.50
  • Documented campaign: +0.40

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 30 documents and public datasets.

Hype components

Headline sample (25%)
50/100
Press, 30 days (60%)
10/100
Grounded branding (15%)
0/100
HYPE TOTAL18/100

Sources and documents

Tenable Blog
Press · 30 Oct 2026, 01:42 · php2shell one week later: Why one exploit doesn’t work everywhere
Cisco Talos Blog
Press · 20 Oct 2026, 15:31 · There's only so much code: the rise in vulnerability numbers
Huntress
Press · 11 Jul 2025, 07:00 · CVE-2021-44228: Log4Shell (Apache Log4j RCE) Vulnerability - Huntress
SECURITY.COM
Press · 06 Oct 2024, 14:49 · Apache Log4j Zero-Day Being Exploited in the Wild - SECURITY.COM
SentinelOne
Press · 14 May 2024, 07:00 · CVE-2021-44228: Remediation Guidance for Log4j Zero-Day RCE - SentinelOne
See all 30 source documents
Esri
Press · 22 May 2023, 07:00 · ArcGIS and Apache Log4j Vulnerabilities - Esri
Workday Blog
Press · 22 Dec 2021, 08:00 · Workday Response on CVE-2021-44228 Apache Log4j - Workday Blog
wiz.io
Press · 21 Dec 2021, 08:00 · Log4Shell: Wrap all your Log4j fixes before the holidays - wiz.io
Rapid7
Press · 17 Dec 2021, 08:00 · Metasploit Wrap-Up: Dec. 17, 2021 - Rapid7
SOC Prime
Press · 17 Dec 2021, 08:00 · CVE-2021-45046, CVE-2021-44228 Detection: Vulnerabilities in Log4j Java Library - SOC Prime
Cloudflare Blog
Press · 15 Dec 2021, 08:00 · Protection against CVE-2021-45046, the additional Log4j RCE vulnerability - Cloudflare Blog
Rapid7
Press · 15 Dec 2021, 08:00 · The Everyperson’s Guide to Log4Shell (CVE-2021-44228) - Rapid7
Rapid7
Press · 14 Dec 2021, 08:00 · Using InsightVM to Find Apache Log4j CVE-2021-44228 - Rapid7
Sonatype
Press · 14 Dec 2021, 08:00 · Log4Shell By the Numbers: Why Did CVE-2021-44228 Set the Internet on Fire? - Sonatype
Cloudflare Blog
Press · 14 Dec 2021, 08:00 · Exploitation of Log4j CVE-2021-44228 before public disclosure and evolution of evasion and exfiltration - Cloudflare Blog
Palo Alto Networks
Press · 13 Dec 2021, 08:00 · Hunting for Log4j CVE-2021-44228 (Log4Shell) Exploit Activity - Palo Alto Networks
Google Cloud
Press · 13 Dec 2021, 08:00 · Cloud IDS helps detect CVE-2021-44228,CVE-2021-45046, CVE-2021-4104, CVE-2021-45105 & CVE-2021-44832 Apache Log4J vulnerabilities - Google Cloud
Securelist
Press · 13 Dec 2021, 08:00 · CVE-2021-44228 vulnerability in Apache Log4j library - Securelist
Palo Alto Networks
Press · 12 Dec 2021, 08:00 · Update: Prisma Cloud Addresses Log4Shell: CVE-2021-44228, CVE-2021-45046 Mitigations - Palo Alto Networks
Microsoft
Press · 11 Dec 2021, 08:00 · Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability - Microsoft
Akamai
Press · 11 Dec 2021, 08:00 · CVE-2021-44228 - Zero Day Vulnerability in Apache Log4j That Allows Remote Code Execution (RCE) - Akamai
Check Point Blog
Press · 11 Dec 2021, 08:00 · Apache Log4j Vulnerability - Check Point Blog
Rapid7
Press · 10 Dec 2021, 08:00 · Widespread Exploitation of Critical Remote Code Execution in Apache Log4j - Rapid7
Cisco Talos Blog
Press · 10 Dec 2021, 08:00 · Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild - Cisco Talos Blog
Cloudflare Blog
Press · 10 Dec 2021, 08:00 · Actual CVE-2021-44228 payloads captured in the wild - Cloudflare Blog
National Cyber Security Centre
Press · 10 Dec 2021, 08:00 · Alert: Apache Log4j vulnerabilities - National Cyber Security Centre
Cloudflare Blog
Press · 10 Dec 2021, 08:00 · CVE-2021-44228 - Log4j RCE 0-day mitigation - Cloudflare Blog
Cloudflare Blog
Press · 10 Dec 2021, 08:00 · Inside the Log4j2 vulnerability (CVE-2021-44228) - Cloudflare Blog
Huntress
Press · 10 Dec 2021, 08:00 · Critical RCE Vulnerability Updates (log4j - CVE-2021-44228) - Huntress
SentinelOne
Press · 09 Dec 2021, 08:00 · CVE-2021-44228: Apache Log4j Vulnerability - SentinelOne

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 1.9 · reality 9.4 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

59

Public exploit entries / repo candidates

See 30 repos with metrics
RepositoryStarsForksLanguageUpdated
kozmer/log4j-shell-poc1,843538Python12 Feb 2024, 22:37
Puliczek/CVE-2021-44228-PoC-log4j-bypass-words952132Java15 Jan 2022, 16:18
Puliczek/awesome-list-of-secrets-in-environment-variables91277—21 Sep 2022, 12:57
leonjza/log4jpwn31087Python15 Dec 2021, 17:18
alexandre-lavoie/python-log4rce17929Python16 Dec 2021, 18:34
aalex954/Log4PowerShell7512C11 Mar 2024, 23:52
cyberxml/log4j-poc7233Java21 Dec 2022, 21:11
For-ACGN/Log4Shell5818Go23 Dec 2021, 09:01
faisalfs10x/Log4j2-CVE-2021-44228-revshell182Python21 Dec 2021, 19:48
ab0x90/CVE-2021-44228_PoC161Python15 Dec 2021, 11:23
obscuritylabs/log4shell-poc-lab91Dockerfile17 Dec 2021, 17:21
Labout/log4shell-rmi-poc84Java19 Dec 2021, 22:09
sunnyvale-it/CVE-2021-44228-PoC85Java13 Dec 2021, 21:23
KosmX/CVE-2021-44228-example72Java17 Dec 2021, 17:16
marcourbano/CVE-2021-4422876Java22 Sep 2022, 19:16
mrlnstk/cve-2021-44228-minecraft-poc60Java12 Dec 2021, 11:34
ankur-katiyar/log4j-docker52Makefile20 Dec 2021, 16:39
many-fac3d-g0d/apache-tomcat-log4j50HTML24 Dec 2021, 18:57
shamo0/CVE-2021-4422841Shell16 Dec 2021, 10:00
badb33f/Apache-Log4j-POC31Java22 Dec 2021, 22:51
Sma-Das/Log4j-PoC30Java14 Mar 2023, 18:50
ubitech/cve-2021-44228-rce-poc32Java15 Dec 2021, 23:03
unlimitedsola/log4j2-rce-poc32Kotlin12 Dec 2021, 09:59
ColdFusionX/CVE-2021-44228-Log4Shell-POC21Java20 Jan 2022, 15:28
0xalwayslucky/log4j-polkit-poc12Dockerfile28 Jan 2022, 15:08
bcdunbar/CVE-2021-44228-poc10Java29 Sep 2022, 22:57
gyaansastra/CVE-2021-4422810—21 Dec 2021, 07:03
mn-io/log4j-spring-vuln-poc10Java22 Dec 2021, 08:58
sec13b/CVE-2021-44228-POC15Python06 Nov 2024, 18:16
uint0/cve-2021-44228--spring-hibernate10Java11 Dec 2021, 06:25
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Campaign documented
Priority basis
Recorded exploitation; CVSS 10; EPSS 100.0%
Attention, last 30 days
2 distinct story titles; 2 press documents; 2 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation; At least two explicitly independent confirmations; Trusted documented campaign

Score evaluated: 2026-11-05 13:58:32.072469+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Primary reports used by this score

  • Microsoft Threat Intelligence

    Microsoft Defender observed Log4Shell exploitation followed by Khonsari ransomware execution.

    Scope: Historical Microsoft telemetry, including compromised Minecraft clients; not evidence of a current campaign.

    Attack observation: not dated; source reviewed 2026-11-02.

  • VMware Threat Analysis Unit

    VMware documents its own NSX detection telemetry and post-exploitation payloads.

    Scope: Historical NSX network telemetry distinguishes scanning from exploitation attempts; it does not quantify global compromises.

    Attack observation: not dated; source reviewed 2026-11-02.

Source event timeline
First press mention
09 Dec 2021, 08:00
Published
10 Dec 2021, 00:00
Added to the CISA KEV catalog
10 Dec 2021, 00:00
Latest press mention
30 Oct 2026, 01:42
Score calculated
05 Nov 2026, 13:58
PoCs on GitHub
59 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar