CVE-2021-44832 Public exploit Medium · 6.6 EPSS 97.9%

Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Apache Software Foundation · Apache Log4j2

Summary

Apache Log4j2, from the Apache Software Foundation, contains a flaw in its JDBC Appender where a JNDI LDAP data source URI in the logging configuration is processed without adequate validation. An attacker who controls the target LDAP server can achieve remote code execution, but only when the configuration uses a JDBC Appender with such a JNDI LDAP data source, and the affected versions span 2.0-beta7 through 2.17.0, excluding the security fix releases 2.3.2 and 2.12.4.

Official description · CVE.org

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Breakdown

81.5 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 1
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 14 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.

Disclosed28 Dec 2021day 0
Public exploit codePoC-in-GitHub29 Dec 2021+1 day
First seen exploitedVulnCheck KEV evidence14 Feb 2023+14 mo

7 fixes in log4j-core over 4 years. The latest fix listed for log4j-core is 2.25.4.

Fixes in log4j-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2.15.0CVE-2021-4422810 Dec 2021KEV
2.16.0CVE-2021-4504614 Dec 2021KEV
2.17.0CVE-2021-4510518 Dec 2021
2.17.1CVE-2021-4483228 Dec 2021
2.25.3CVE-2025-6816118 Dec 2025
2.25.4CVE-2026-3447710 Apr 2026
2.25.4CVE-2026-3447810 Apr 2026Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

Remote attacker exploits Log4j2 application over network

remote code execution (RCE) attack when a configuration uses a JDBC Appender

From the official description (CVE.org) Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

Arbitrary code execution via JNDI lookup

remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP

From the official description (CVE.org) Original ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2021-44832 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: org.apache.logging.log4j:log4j-core.

Mavenorg.apache.logging.log4j:log4j-coreGHSA-8489-44mv-ggj8

Upgrade to 2.17.1 or later

Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2021-44228, CVE-2021-45046, +1).

Set the version to 2.17.1 or later in your pom.xml or build.gradle.

The first fix for CVE-2021-44832.

Affected versions, by release line

If you run	Upgrade to
2.13.0 up to 2.17.1	2.17.1
2.4 up to 2.12.4	2.12.4
2.0-beta7 up to 2.3.2 Still affected on this line by CVE-2017-5645 (fixed in 2.8.2, a newer line).	2.3.2

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

Mavenorg.ops4j.pax.logging:pax-logging-log4j2
Affected: 2.0.0 up to 2.0.14; 1.11.0 up to 1.11.13; 1.10.0 up to 1.10.9; 1.8.0 up to 1.9.2Upgrade to 2.0.14 or later (older lines: 1.11.13, 1.10.9, 1.9.2)
GHSA-8489-44mv-ggj8

Check your lockfile against all CVEs

What security researchers reported

Named in 1 threat report

1 reportLinkedIn

Reports are matched by finding the exact id CVE-2021-44832 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

LinkedInUndated

RaaS AvosLocker Incident Response Analysis

…vulnerabilities associated to Log4J were found on the VMWare Horizon Unified Access Gateways, UAG01 and UAG02, those were CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832, which can potentially allow remote code execution on Unified Access Gateway by the low privilege non-root user named…

Original (opens in a new tab) ↗

Also mentioned in 29 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

APT291 May 2026
dfirfanatic_IOC's27 Mar 2025
How APT groups operate in the Middle East - May 202417 May 2024
How APT groups operate in the Middle East4 Apr 2024
ACTUALIZACION | Oracle Critical Patch Update Advisory - July 202321 Jul 2023
ACTUALIZACION | A vulnerability in Apache Log4j affects some features of IBM® Db2® (CVE-2021-44832)12 Nov 2022
23 more on OTX

References

12 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-0516

Public exploitAdvisories link exploit code.

, 30 Oct 2026

97.9%Top 0.09%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.91%).

3.1

6.6Medium · 6.6

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 1355 days ago 0.0/10

Known ransomware useVulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9991 20.0/20

Threat reports1 report 3.9/10

Public exploit code2 PoC-in-GitHub repos 5.0/5

Mentioned in OTX pulses29 pulses 3.0/3

CVSS base scorebase score 6.6 4.6/7

End-of-life productsupported or unknown 0.0

Total81.5

Record

Published: 28 Dec 2021
Modified: 29 May 2026
: CWE-20 Improper Input ValidationCWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in log4j-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

RaaS AvosLocker Incident Response Analysis

Also mentioned in 29 community threat pulses (AlienVault OTX)

References

vendor-advisory 3

x_refsource_MISC 5

mailing-list 2

x_refsource_CONFIRM 2

How attackers get in

What they do

techniques