CVE-2021-44228

● KEV CRITICAL ⚠ Exploit

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker cont...

Affects 169 products across 19 vendors.

BCS10.0
CVSS 3.110.0
EPSS100.0%
Percentile100th
PatchPatched
KEV Added2021-12-10
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-20: Improper Input Validation

Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.

CWE-400: Uncontrolled Resource Consumption (DoS)

Software does not properly limit resource usage, allowing an attacker to exhaust CPU, memory, disk, or bandwidth.

CWE-502: Deserialization of Untrusted Data

Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.

CWE-917: CWE-917
Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-20
CAPEC-7 Blind SQL Injection
via CWE-20
CAPEC-8 Buffer Overflow in an API Call
via CWE-20
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-20
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-20
Show all 55
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A critical vulnerability in Apache Log4j2, a widely used logging library, allows attackers to execute arbitrary code on affected systems. This can lead to full system compromise, data exfiltration, and potential disruption of industrial processes. Organizations using Log4j2 in their OT environments are at high risk, especially if the logging library is integrated into critical applications or devices.

BSID: BS-2021-GLOBAL-298547-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-44228?
A critical vulnerability in Apache Log4j2, a widely used logging library, allows attackers to execute arbitrary code on affected systems. This can lead to full system compromise, data exfiltration, and potential disruption of industrial processes. Organizations using Log4j2 in their OT environments are at high risk, especially if the logging library is integrated into critical applications or devices.
What is the CVSS score for CVE-2021-44228?
CVE-2021-44228 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 100.0%.
Is CVE-2021-44228 actively exploited?
Yes. CVE-2021-44228 is in the CISA KEV catalog (added 2021-12-10). Active exploitation confirmed. Immediate patching required.
How do I remediate CVE-2021-44228?
Priority: IMMEDIATE. Advisory: https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ PSIRT: [email protected]
What systems are affected by CVE-2021-44228?
CVE-2021-44228 affects: Apache, Apple, Bentley, Bentley, Cisco, Cisco, Cisco, Cisco.
What NERC-CIP standard applies to CVE-2021-44228?
NERC CIP CIP-007 CIP-007-R1: CIP-007-R1 requires the identification and disabling of unnecessary ports and services. The vulnerable JNDI feature in Log4j2 represents an unnecessary service that should be disabled on BES Cyber Assets.
What IEC 62443 requirement maps to CVE-2021-44228?
IEC 62443 SR 7.6: IEC 62443 SR 7.6 (Secure Software Development) is violated. The vulnerability arises from a lack of input validation and secure coding practices in the Log4j2 library, allowing for remote code execution.
Vulnerability Details
CVE IDCVE-2021-44228
BSIDBS-2021-GLOBAL-298547-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2021-12-10
Last Modified2026-02-20
ICS Relevance100%
Weakness (CWE)
Verticals
ICS-OT
Domains
NETWORK-INFRA
SourceNVD
Official Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists in the JNDI (Java Naming and Directory Interface) feature of Apache Log4j2. An attacker can craft a log message containing a malicious JNDI lookup string, which, when processed by the vulnerable Log4j2 library, triggers a lookup to an attacker-controlled LDAP server. The LDAP server returns a Java class that is then executed on the victim's system. The attacker needs no authentication and can exploit this vulnerability remotely. Post-exploitation, the attacker gains full control of the affected system, potentially leading to data exfiltration, command execution, and disruption of industrial processes. In an OT environment, this could affect engineering workstations, historians, and other critical systems.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Apache Log4J
Apple Xcode
Bentley Synchro 4D
Bentley Synchro
Cisco Unified Contact Center Express
Cisco Identity Services Engine
Cisco Unified Computing System
Cisco Unity Connection
Cisco Webex Meetings Server
Cisco Video Surveillance Operations Manager
Cisco Video Surveillance Manager
Cisco Finesse
Cisco Mobility Services Engine
Cisco Ucs Director
Cisco Unified Communications Manager Im And Presence Service
Cisco Prime Service Catalog
Cisco Unified Intelligence Center
Cisco Integrated Management Controller Supervisor
Cisco Virtual Topology System
Cisco Evolved Programmable Network Manager
Cisco Fog Director
Cisco Firepower Threat Defense
Cisco Data Center Network Manager
Cisco Fxos
Cisco Firepower 9300
Cisco Firepower 2110
Cisco Firepower 2120
Cisco Firepower 2130
Cisco Firepower 2140
Cisco Firepower 4110
Cisco Firepower 4120
Cisco Firepower 4140
Cisco Firepower 4150
Cisco Virtualized Voice Browser
Cisco Network Services Orchestrator
Cisco Network Assurance Engine
Cisco Packaged Contact Center Enterprise
Cisco Connected Mobile Experiences
Cisco Firepower 4112
Cisco Firepower 4115
Cisco Firepower 4125
Cisco Firepower 4145
Cisco Enterprise Chat And Email
Cisco Common Services Platform Collector
Cisco Emergency Responder
Cisco Firepower 1120
Cisco Firepower 1140
Cisco Dna Spaces\
Cisco Crosswork Network Automation
Cisco Firepower 1150
Cisco Sd-Wan Vmanage
Cisco Unified Communications Manager Im \& Presence Service
Cisco Business Process Automation
Cisco Intersight Virtual Appliance
Cisco Nexus Insights
Cisco Advanced Malware Protection Virtual Private Cloud Appliance
Cisco Automated Subsea Tuning
Cisco Broadworks
Cisco Cloud Connect
Cisco Cloudcenter
Cisco Cloudcenter Cost Optimizer
Cisco Cloudcenter Suite Admin
Cisco Cloudcenter Workload Manager
Cisco Contact Center Domain Manager
Cisco Contact Center Management Portal
Cisco Crosswork Data Gateway
Cisco Crosswork Network Controller
Cisco Crosswork Optimization Engine
Cisco Crosswork Platform Infrastructure
Cisco Crosswork Zero Touch Provisioning
Cisco Customer Experience Cloud Agent
Cisco Cyber Vision Sensor Management Extension
Cisco Dna Center
Cisco Iot Operations Dashboard
Cisco Nexus Dashboard
Cisco Optical Network Controller
Cisco Paging Server
Cisco Smart Phy
Cisco Ucs Central
Cisco Virtualized Infrastructure Manager
Cisco Wan Automation Engine
Cisco Workload Optimization Manager
Cisco Unified Sip Proxy
Cisco Unified Workforce Optimization
Cisco Cloudcenter Suite
Cisco Cx Cloud Agent
Cisco Cyber Vision
Cisco Dna Spaces
Cisco Dna Spaces Connector
Cisco Network Dashboard Fabric Controller
Cisco Network Insights For Data Center
Cisco Ucs Central Software
Cisco Unified Contact Center Management Portal
Cisco Unified Communications Manager Im & Presence Service
Cisco Firepower 1010
Cisco Unified Contact Center Enterprise
Cisco Unified Communications Manager
Cisco Unified Customer Voice Portal
Debian Debian Linux
Fedoraproject Fedora
Fujitsu-Siemens —
Honeywell —
Intel Secure Device Onboard
Intel Computer Vision Annotation Tool
Intel Datacenter Manager
Intel Genomics Kernel Library
Intel Oneapi Sample Browser
Intel System Studio
Johnsoncontrols —
Michael K. Johnson —
Netapp Cloud Insights
Netapp Solidfire \& Hci Storage Node
Netapp Cloud Secure Agent
Netapp Ontap Tools
Netapp Cloud Manager
Netapp Brocade San Navigator
Netapp Solidfire Enterprise Sds
Netapp Solidfire & Hci Storage Node
Netapp Snapcenter
Netapp Active Iq Unified Manager
Netapp Oncommand Insight
Percussion Rhythmyx
Rockwell Automation —
Schneider-Electric —
Siemens Energy Engage
Siemens Energyip
Siemens Energyip Prepay
Siemens Head-End System Universal Device Integration System
Siemens Industrial Edge Management Hub
Siemens Mindsphere
Siemens Navigator
Siemens Nx
Siemens Sentron Powermanager
Siemens Siguard Dsa
Siemens Siveillance Command
Siemens Siveillance Identity
Siemens Siveillance Vantage
Siemens Sipass Integrated
Siemens Solid Edge Cam Pro
Siemens Solid Edge Harness Design
Siemens Teamcenter
Siemens Vesys
Siemens Xpedition Enterprise
Siemens Xpedition Package Integrator
Siemens Logo! Soft Comfort
Siemens Comos
Siemens Siveillance Viewpoint
Siemens Logo\! Soft Comfort
Siemens Spectrum Power 4
Siemens Spectrum Power 7
Siemens Opcenter Intelligence
Siemens Mendix
Siemens Siveillance Control Pro
Siemens Gma-Manager
Siemens Operation Scheduler
Siemens Industrial Edge Management
Siemens 6Bk1602-0Aa12-0Tp0 Firmware
Siemens 6Bk1602-0Aa12-0Tp0
Siemens 6Bk1602-0Aa22-0Tp0 Firmware
Siemens 6Bk1602-0Aa22-0Tp0
Siemens 6Bk1602-0Aa32-0Tp0 Firmware
Siemens 6Bk1602-0Aa32-0Tp0
Siemens 6Bk1602-0Aa42-0Tp0 Firmware
Siemens 6Bk1602-0Aa42-0Tp0
Siemens 6Bk1602-0Aa52-0Tp0 Firmware
Siemens 6Bk1602-0Aa52-0Tp0
Siemens Sppa-T3000 Ses3000 Firmware
Siemens Sppa-T3000 Ses3000
Siemens Capital
Siemens Desigo Cc Advanced Reports
Siemens Desigo Cc Info Center
Siemens E-Car Operation Center
Snowsoftware Snow Commander
Snowsoftware Vm Access Proxy
Sonicwall Email Security
Wolfram Schneider —
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: July 2026 | Threat Age: 1688 Days
CISA KEV● Active Exploitation Confirmed (added 2021-12-10)
Public Exploit⚠ AvailableReference
PoC CodeNot confirmed
● Virtual Patch — CITED Relevance SAGE Engine MEDIUM CONFIDENCE

Implement strict egress filtering at the perimeter firewall to block outbound LDAP (TCP 389) and RMI (TCP 1099) traffic. Ensure all logging configurations disable JNDI lookups. Apply network segmentation to isolate critical systems from general IT networks. Monitor for unusual outbound connections from affected systems.

No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.

NERC CIP: CIP-007 CIP-007-R1
CIP-007-R1 requires the identification and disabling of unnecessary ports and services. The vulnerable JNDI feature in Log4j2 represents an unnecessary service that should be disabled on BES Cyber Assets.
IEC 62443: SR 7.6
IEC 62443 SR 7.6 (Secure Software Development) is violated. The vulnerability arises from a lack of input validation and secure coding practices in the Log4j2 library, allowing for remote code execution.

Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.

SAGE Enrichment Record — provenance & audit hash
ModelQwen/Qwen2.5-72B-Instruct-AWQ
ConfidenceHIGH
Enriched At2026-05-23
SHA-512 Audit Hashddd97ebb5517a849bc846026fef8e8027b2910f19ace5f1b0b67ea51d05721e76e57e25cf7a5ae1d65a2d367f581fc588c2ce086c2f5bc9f42ba0ecd96f04af9
Related CVEs affecting Apache
CVE-1999-0067 10.0 phf CGI program allows remote command execution through shell metacharacters. CVE-1999-0926 10.0 Apache allows remote attackers to conduct a denial of service via a large num... CVE-1999-1293 10.0 mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a deni... CVE-2010-0425 10.0 modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 ... CVE-2003-0789 10.0 mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properl...
View all Apache CVEs →

This Vulnerability Is Being Actively Exploited

CVE-2021-44228 is on the CISA KEV list - confirmed active exploitation in the wild. BreachSpider alerts your team within 15 minutes when KEV vulnerabilities match your ICS assets.

Start Free KEV Monitoring →