CVE-2021-44228 · Log4Shell

No source can show you its own past. This one can.

Print this page to keep the view as it stands on this date. Everything hidden behind a disclosure opens, and every receipt prints with its value.

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

CVE-2021-442284 of 4 sources documented this

rank 90 = 40 + 25 + 0 + 19 + 6

rank@v1 · act now

Exploitation evidence40/40EPSS 0.99999 · CISA KEV listed

Someone is already using it

CISA KEV catalog · public proof-of-concept · FIRST EPSS

EPSS 0.99999 · CISA KEV listed · without this subject the record ranks 50

Impact25/25CVSS 10.0, from NVD

What it costs you if it fires

NVD CVSS base score, then the CNA's own

CVSS 10.0, from NVD · without this subject the record ranks 65

Movement0/15no persisting rise in 365 days

It is getting worse, not staying still

FIRST EPSS series, rescorings and bad loads removed

no persisting rise in 365 days · without this subject the record ranks 90

Blast radius19/10323 products in the CPE ranges

How much of the world it touches

NVD CPE configurations

323 products in the CPE ranges · without this subject the record ranks 71

Obligation6/10CISA remediation date held

Someone else already set the date

CISA KEV remediation due date

CISA remediation date held · without this subject the record ranks 84

Hindsight · the state

Severity10 CRITICALreceipt

Harmtotal loss · unauthenticated · ransomware-linkedreceipt

Exploitationransomware use knownreceipt

Defensefix version namedreceipt

Movementscoring model changedreceipt

PLATEAUMinimal movement since 2021-12-17, 1722 days at 1.00, as of 2026-09-04. arc-rules@v1

Foresight · where to check next

log4j2 is one instance of CWE-502, deserialization of untrusted data. The index holds 3512 prior instances of this class, 75 KEV-listed. 6 neighbors share the mechanism; each carries its own record state. taxonomy@v1

Full pattern panel

Listed for shared mechanism, not known vulnerability.

Color is a claim, not decoration:the hostile worldthe defenseno signal

Running Apache Log4j2? Check your version

A deterministic range check against the ranges this record publishes. It tells you where a version sits in the record, not whether your deployment is exploitable. No account needed.

Watch this record

Matches your own product list against every record this index holds, and tells you when one of them moves.

What counts as a move

Watch Apache Log4j2

Set up a watchlist (free with an account: one stack of three products)

Record your call

Keep your verdict, your reason and the evidence together. The record takes its date when you save it.

Or open an investigation: an incident or a near miss on this CVE, kept with its evidence where anyone in your organisation can find it.

Choose your verdict, then sign in or use an email link. Your first 100 records are free. Evidence is frozen when the record is created.

Private to your organization unless you share it. Put the proof link in your ticket so a reviewer can inspect the basis for your call. See how decision records work.

Harm, if it fires from the vector and the weakness

Written for the ticket you're about to file.

Reachnetwork-reachable · no privileges required · no user interaction · low attack complexityreceipt

ImpactComplete confidentiality, integrity and availability loss, with impact beyond the vulnerable componentreceipt

Scored fromCVSS v3.1 · NVD's vectorreceipt

Weakness classCWE-502 Deserialization of Untrusted Data; CWE-400 Uncontrolled Resource Consumption; CWE-20 Improper Input Validationreceipt

Published consequencesCWE-502: Integrity: Modify Application Data, Unexpected State; Availability: DoS: Resource Consumption (CPU); Other: Varies by Contextcwe-consequences@4.20

Ransomware campaign useKnown (CISA)receipt

CISA KEV & Federal Remediation Deadline from the record and CISA

The fix, and how long it's been waiting.

Fixed in2.3.1; 2.12.2; 2.15.0receipt

Patch available sinceNo dated patch-availability record in held sources. The index holds reference URLs without dates and only the current revision of the CVE record, so the day a fix first existed cannot be derived. Only the versions it landed in.

CISA remediation statusoverdue since 2021-12-24receipt

CISA required actionFor all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures…receipt

Show full CISA required action

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

BOD 26-04 deadlineNot worked out yet. CISA scores every KEV entry for the directive, and this index has not loaded its scoring for this one.

Published to CISA KEVsame dayderived

Exploit Status & Known PoCs a ladder, not a score

Current rung: Ransomware campaign use known, 2021-12-10.

RUNG 1Nothing observed in held sources
RUNG 2Proof-of-concept published · 418 public repositories2021-12-09receipt
RUNG 3Exploited in the wild · CISA KEV listed2021-12-10receipt
RUNG 4Ransomware campaign use known2021-12-10receipt

Authority who says so

CVSS, NVD10 CRITICALreceipt

Exploit probability0.99999 · top 0.01% of all CVEsreceipt

Blast breadth109 products across 11 vendorsderived

Assigned byapachereceipt

Recorded changes123 · last 4 Sep 2026derived

Affected & Fixed Versions as published

Affected productApache Software Foundation Apache Log4j2receipt

Published rangesapache log4j >= 2.0.1 < 2.3.1; apache log4j >= 2.4.0 < 2.12.2; apache log4j >= 2.13.0 < 2.15.0; apache log4j 2.0receipt

Show all 323 published ranges

apache log4j >= 2.0.1 < 2.3.1

apache log4j >= 2.4.0 < 2.12.2

apache log4j >= 2.13.0 < 2.15.0

apache log4j 2.0

apache log4j 2.0-beta9

apache log4j 2.0-rc1

apache log4j 2.0-rc2

siemens 6bk1602-0aa12-0tp0 firmware < 2.7.0

siemens 6bk1602-0aa22-0tp0 firmware < 2.7.0

siemens 6bk1602-0aa32-0tp0 firmware < 2.7.0

siemens 6bk1602-0aa42-0tp0 firmware < 2.7.0

siemens 6bk1602-0aa52-0tp0 firmware < 2.7.0

siemens capital < 2019.1

siemens capital 2019.1

siemens capital 2019.1-sp1912

siemens comos < 10.4.2

siemens desigo cc advanced reports 3.0

siemens desigo cc advanced reports 4.0

siemens desigo cc advanced reports 4.1

siemens desigo cc advanced reports 4.2

siemens desigo cc advanced reports 5.0

siemens desigo cc advanced reports 5.1

siemens desigo cc info center 5.0

siemens desigo cc info center 5.1

siemens e-car operation center < 2021-12-13

siemens energy engage 3.1

siemens energyip 8.5

siemens energyip 8.6

siemens energyip 8.7

siemens energyip 9.0

siemens energyip prepay < 3.8.0.12

siemens gma-manager < 8.6.2j-398

siemens industrial edge management hub < 2021-12-13

siemens mindsphere < 2021-12-16

siemens navigator < 2021-12-13

siemens opcenter intelligence >= 3.2 < 3.5

siemens operation scheduler <= 1.1.3

siemens sentron powermanager 4.1

siemens sentron powermanager 4.2

siemens siguard dsa >= 4.2 < 4.4.1

siemens sipass integrated 2.80

siemens sipass integrated 2.85

siemens siveillance command <= 4.16.2.1

siemens siveillance identity 1.5

siemens siveillance identity 1.6

siemens solid edge harness design < 2020

siemens solid edge harness design 2020

siemens solid edge harness design 2020-sp2002

siemens spectrum power 4 < 4.70

siemens spectrum power 4 4.70

siemens spectrum power 4 4.70-sp7

siemens spectrum power 4 4.70-sp8

siemens spectrum power 7 < 2.30

siemens spectrum power 7 2.30

siemens spectrum power 7 2.30-sp2

siemens vesys < 2019.1

siemens vesys 2019.1

siemens vesys 2019.1-sp1912

siemens vesys 2020.1

siemens vesys 2021.1

intel datacenter manager < 5.1

debian linux 9.0

debian linux 10.0

debian linux 11.0

fedoraproject fedora 34

fedoraproject fedora 35

sonicwall email security < 10.0.13

cisco advanced malware protection virtual private cloud appliance < 3.5.4

cisco automated subsea tuning < 2.1.0

cisco broadworks < 2021.11_1.162

cisco business process automation < 3.0.000.115

cisco business process automation >= 3.1.000.000 < 3.1.000.044

cisco business process automation >= 3.2.000.000 < 3.2.000.009

cisco cloud connect < 12.6$1$

cisco cloudcenter < 4.10.0.16

cisco cloudcenter cost optimizer < 5.5.2

cisco cloudcenter suite admin < 5.3.1

cisco cloudcenter workload manager < 5.5.2

cisco common services platform collector < 2.9.1.3

cisco common services platform collector >= 2.10.0 < 2.10.0.1

cisco contact center domain manager < 12.5$1$

cisco contact center management portal < 12.5$1$

cisco crosswork data gateway < 2.0.2

cisco crosswork data gateway 3.0.0

cisco crosswork network controller < 2.0.1

cisco crosswork network controller 3.0.0

cisco crosswork optimization engine < 2.0.1

cisco crosswork optimization engine 3.0.0

cisco crosswork platform infrastructure < 4.0.1

cisco crosswork platform infrastructure 4.1.0

cisco crosswork zero touch provisioning < 2.0.1

cisco crosswork zero touch provisioning 3.0.0

cisco customer experience cloud agent < 1.12.1

cisco cyber vision sensor management extension < 4.0.3

cisco data center network manager < 11.3$1$

cisco data center network manager 11.3$1$

cisco dna center < 2.1.2.8

cisco dna center >= 2.2.2.0 < 2.2.2.8

cisco dna center >= 2.2.3.0 < 2.2.3.4

cisco dna spaces\ < 2.5

cisco emergency responder < 11.5$4$

cisco enterprise chat and email < 12.0$1$

cisco evolved programmable network manager <= 4.1.1

cisco finesse < 12.6$1$

cisco finesse 12.6$1$

cisco identity services engine < 2.4.0

cisco identity services engine 2.4.0

cisco integrated management controller supervisor < 2.3.2.1

cisco intersight virtual appliance < 1.0.9-361

cisco network assurance engine < 6.0.2

cisco network services orchestrator < 5.3.5.1

cisco network services orchestrator >= 5.4 < 5.4.5.2

cisco network services orchestrator >= 5.5 < 5.5.4.1

cisco network services orchestrator >= 5.6 < 5.6.3.1

cisco nexus dashboard < 2.1.2

cisco nexus insights < 6.0.2

cisco optical network controller < 1.1.0

cisco packaged contact center enterprise < 11.6

cisco packaged contact center enterprise 11.6$1$

cisco paging server < 14.4.1

cisco prime service catalog < 12.1

cisco sd-wan vmanage < 20.3.4.1

cisco sd-wan vmanage >= 20.4 < 20.4.2.1

cisco sd-wan vmanage >= 20.5 < 20.5.1.1

cisco sd-wan vmanage >= 20.6 < 20.6.2.1

cisco smart phy < 3.2.1

cisco ucs central < 2.0$1p$

cisco ucs director < 6.8.2.0

cisco unified communications manager < 11.5$1$

cisco unified communications manager 11.5$1$

cisco unified communications manager 11.5$1$su3

cisco unified communications manager im and presence service < 11.5$1$

cisco unified communications manager im and presence service 11.5$1$

cisco unified contact center enterprise < 11.6$2$

cisco unified contact center enterprise 11.6$2$

cisco unified contact center express < 12.5$1$

cisco unified customer voice portal < 11.6

cisco unified customer voice portal 11.6

cisco unified customer voice portal 12.0

cisco unified customer voice portal 12.5

cisco unified intelligence center < 12.6$1$

cisco unity connection < 11.5$1$

cisco video surveillance operations manager < 7.14.4

cisco virtual topology system < 2.6.7

cisco virtualized infrastructure manager < 3.2.0

cisco virtualized infrastructure manager >= 3.4.0 < 3.4.4

cisco virtualized voice browser < 12.5$1$

cisco wan automation engine < 7.3.0.2

cisco webex meetings server < 3.0

cisco webex meetings server 3.0

cisco webex meetings server 3.0-maintenance_release1

cisco webex meetings server 3.0-maintenance_release2

cisco webex meetings server 3.0-maintenance_release3

cisco webex meetings server 3.0-maintenance_release3_security_patch4

cisco webex meetings server 3.0-maintenance_release3_security_patch5

cisco webex meetings server 3.0-maintenance_release3_service_pack_2

cisco webex meetings server 3.0-maintenance_release3_service_pack_3

cisco webex meetings server 3.0-maintenance_release4

cisco webex meetings server 4.0

cisco webex meetings server 4.0-maintenance_release1

cisco webex meetings server 4.0-maintenance_release2

cisco webex meetings server 4.0-maintenance_release3

cisco workload optimization manager < 3.2.1

cisco unified sip proxy < 10.2.1v2

cisco unified workforce optimization < 11.5$1$

cisco fxos 6.2.3

cisco fxos 6.3.0

cisco fxos 6.4.0

cisco fxos 6.5.0

cisco fxos 6.6.0

cisco fxos 6.7.0

cisco fxos 7.0.0

cisco fxos 7.1.0

cisco automated subsea tuning 02.01.00

cisco cloudcenter suite 4.10.0.15

cisco cloudcenter suite 5.3.0

cisco cloudcenter suite 5.4.1

cisco cloudcenter suite 5.5.0

cisco cloudcenter suite 5.5.1

cisco common services platform collector 002.009$000.000$

cisco common services platform collector 002.009$000.001$

cisco common services platform collector 002.009$000.002$

cisco common services platform collector 002.009$001.000$

cisco common services platform collector 002.009$001.001$

cisco common services platform collector 002.009$001.002$

cisco common services platform collector 002.010$000.000$

cisco crosswork network automation 2.0.0

cisco crosswork network automation 3.0.0

cisco crosswork network automation 4.1.0

cisco crosswork network automation 4.1.1

cisco cx cloud agent 001.012

cisco cyber vision 4.0.2

cisco cyber vision sensor management extension 4.0.2

cisco dna center 2.2.2.8

cisco emergency responder 11.5

cisco emergency responder 11.5$4.65000.14$

cisco emergency responder 11.5$4.66000.14$

cisco enterprise chat and email 12.0$1$

cisco enterprise chat and email 12.5$1$

cisco enterprise chat and email 12.6$1$

cisco evolved programmable network manager 3.0

cisco evolved programmable network manager 3.1

cisco evolved programmable network manager 4.0

cisco evolved programmable network manager 4.1

cisco evolved programmable network manager 5.0

cisco evolved programmable network manager 5.1

cisco finesse 12.5$1$-su1

cisco finesse 12.5$1$-su2

cisco finesse 12.6$1$-es01

cisco finesse 12.6$1$-es02

cisco finesse 12.6$1$-es03

cisco identity services engine 002.004$000.914$

cisco identity services engine 002.006$000.156$

cisco identity services engine 002.007$000.356$

cisco identity services engine 003.000$000.458$

cisco identity services engine 003.001$000.518$

cisco identity services engine 003.002$000.116$

cisco integrated management controller supervisor 002.003$002.000$

cisco integrated management controller supervisor 2.3.2.0

cisco intersight virtual appliance 1.0.9-343

cisco network assurance engine 6.0$2.1912$

cisco network dashboard fabric controller 11.0$1$

cisco network dashboard fabric controller 11.1$1$

cisco network dashboard fabric controller 11.2$1$

cisco network dashboard fabric controller 11.3$1$

cisco network dashboard fabric controller 11.4$1$

cisco network dashboard fabric controller 11.5$1$

cisco network dashboard fabric controller 11.5$2$

cisco network dashboard fabric controller 11.5$3$

cisco network insights for data center 6.0$2.1914$

cisco optical network controller 1.1

cisco paging server 8.3$1$

cisco paging server 8.4$1$

cisco paging server 8.5$1$

cisco paging server 9.0$1$

cisco paging server 9.0$2$

cisco paging server 9.1$1$

cisco paging server 12.5$2$

cisco paging server 14.0$1$

cisco prime service catalog 12.1

cisco sd-wan vmanage 20.3

cisco sd-wan vmanage 20.4

cisco sd-wan vmanage 20.5

cisco sd-wan vmanage 20.6

cisco sd-wan vmanage 20.6.1

cisco sd-wan vmanage 20.7

cisco sd-wan vmanage 20.8

cisco secure firewall threat defense 6.2.3

cisco secure firewall threat defense 6.3.0

cisco secure firewall threat defense 6.4.0

cisco secure firewall threat defense 6.5.0

cisco secure firewall threat defense 6.6.0

cisco secure firewall threat defense 6.7.0

cisco secure firewall threat defense 7.0.0

cisco secure firewall threat defense 7.1.0

cisco smart phy 3.1.2

cisco smart phy 3.1.3

cisco smart phy 3.1.4

cisco smart phy 3.1.5

cisco smart phy 3.2.1

cisco smart phy 21.3

cisco ucs central software 2.0

cisco ucs central software 2.0$1a$

cisco ucs central software 2.0$1b$

cisco ucs central software 2.0$1c$

cisco ucs central software 2.0$1d$

cisco ucs central software 2.0$1e$

cisco ucs central software 2.0$1f$

cisco ucs central software 2.0$1g$

cisco ucs central software 2.0$1h$

cisco ucs central software 2.0$1k$

cisco ucs central software 2.0$1l$

cisco unified communications manager 11.5$1.17900.52$

cisco unified communications manager 11.5$1.18119.2$

cisco unified communications manager 11.5$1.18900.97$

cisco unified communications manager 11.5$1.21900.40$

cisco unified communications manager 11.5$1.22900.28$

cisco unified communications manager im \& presence service 11.5$1$

cisco unified communications manager im \& presence service 11.5$1.22900.6$

cisco unified computing system 006.008$001.000$

cisco unified contact center enterprise 12.0$1$

cisco unified contact center enterprise 12.5$1$

cisco unified contact center enterprise 12.6$1$

cisco unified contact center enterprise 12.6$2$

cisco unified contact center express 12.5$1$

cisco unified contact center express 12.5$1$-su1

cisco unified contact center express 12.6$1$

cisco unified contact center express 12.6$2$

cisco unified contact center management portal 12.6$1$

cisco unified customer voice portal 11.6$1$

cisco unified customer voice portal 12.0$1$

cisco unified customer voice portal 12.5$1$

cisco unified customer voice portal 12.6$1$

cisco unified intelligence center 12.6$1$

cisco unified intelligence center 12.6$1$-es01

cisco unified intelligence center 12.6$1$-es02

cisco unified intelligence center 12.6$2$

cisco unified sip proxy 010.000$000$

cisco unified sip proxy 010.000$001$

cisco unified sip proxy 010.002$000$

cisco unified sip proxy 010.002$001$

cisco unified workforce optimization 11.5$1$-sr7

cisco unity connection 11.5

cisco unity connection 11.5$1.10000.6$

cisco video surveillance manager 7.14$1.26$

cisco video surveillance manager 7.14$2.26$

cisco video surveillance manager 7.14$3.025$

cisco video surveillance manager 7.14$4.018$

cisco virtual topology system 2.6.6

cisco wan automation engine 7.1.3

cisco wan automation engine 7.2.1

cisco wan automation engine 7.2.2

cisco wan automation engine 7.2.3

cisco wan automation engine 7.3

cisco wan automation engine 7.4

cisco wan automation engine 7.5

cisco wan automation engine 7.6

snowsoftware snow commander < 8.10.0

snowsoftware vm access proxy < 3.6

bentley synchro >= 6.1 < 6.2.4.2

bentley synchro 4d < 6.4.3.2

percussion rhythmyx <= 7.3.2

apple xcode < 13.3

Fixed in2.3.1; 2.12.2; 2.15.0receipt

A rung lights from a row in the index, never from an assessment. "Held sources" is the true scope of the claim: this index reads the CVE record, NVD, CISA KEV, FIRST's EPSS and public proof-of-concept repositories, and it does not observe attacks.

Unaudited dollar value2 of 3 inputs carry a receipt

Exposure$4.99Mover the next 30 days, if this record is yours

Movement+$1.61Mon 2021-12-17, the last material move, 4 years, 8 months before this reading

Basisassumeda published average, not your estate

$4.99M = $4.99M incident cost x 1 exposure x 0.99999 likelihood

udv@v1 · unaudited · wrong for you until you say what you run

$4.99M is the cost of a breach that happened, from IBM Cost of a Data Breach Report 2026, global average. It is not the value of any asset of yours. That average already covers breaches of every severity, so scaling it by exposure understates a partial-impact record. That is an assumption, not a measurement. Your own asset value goes in the decision record.

What it is stated by the CNA

Log4Shell is the common name for CVE-2021-44228. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. cve-aliases@2026-08-27

Read the rest of the CNA's description

Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

NVD's analysis a second authority

severity: 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
weakness: CWE-20; CWE-400; CWE-502; CWE-917
affected versions: apache log4j >= 2.0.1 < 2.3.1; apache log4j >= 2.4.0 < 2.12.2; apache log4j >= 2.13.0 < 2.15.0; and 320 more, listed in full below
also scored by: 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

check it yourself logging.apache.org openwall.com openwall.com tools.cisco.com openwall.com security.netapp.com +14 morereceipt

Dated events

Movement the material steps

11 Dec 20210.15901

14 Dec 20210.50253 · crossed 0.50

17 Dec 20210.91823 · crossed 0.90

7 Mar 20230.97578 · scoring model v2023.03.01

17 Mar 20250.94482 · scoring model v2025.03.14

15 Jun 20260.99999 · scoring model v2026.06.15

This score more than doubled inside 72 hours. Both observations are in the full history below.

Show all 109 observations

11 Dec 20210.15901

13 Dec 20210.18794

14 Dec 20210.50253

15 Dec 20210.56817

16 Dec 20210.59493

17 Dec 20210.91823

20 Dec 20210.92515

21 Dec 20210.92916

22 Dec 20210.93275

27 Dec 20210.936

29 Dec 20210.93275

13 Jan 20220.93442

19 Jan 20220.936

21 Jan 20220.93751

25 Jan 20220.93896

4 Feb 20220.94402

15 Mar 20220.95102

15 Jul 20220.90484

31 Oct 20220.91159

15 Nov 20220.95466

9 Dec 20220.97095

7 Mar 20230.97578

26 Apr 20230.97581

8 May 20230.97568

23 May 20230.97565

3 Jul 20230.97561

8 Jul 20230.97573

15 Jul 20230.97569

18 Jul 20230.97566

1 Aug 20230.97567

15 Aug 20230.97566

22 Sep 20230.97438

29 Sep 20230.97472

27 Oct 20230.97453

9 Nov 20230.97454

6 Jan 20240.97466

7 Feb 20240.97562

17 Feb 20240.97565

15 Mar 20240.97562

12 Apr 20240.97560

24 May 20240.97559

7 Jun 20240.97547

20 Jun 20240.97559

4 Jul 20240.97557

16 Jul 20240.97556

25 Jul 20240.96980

30 Jul 20240.96911

25 Aug 20240.96694

20 Sep 20240.96494

5 Oct 20240.96763

15 Nov 20240.96886

13 Dec 20240.96876

17 Dec 20240.97192

27 Dec 20240.97232

26 Jan 20250.97194

10 Feb 20250.97098

26 Feb 20250.97112

17 Mar 20250.94482

18 Mar 20250.94381

15 Apr 20250.94482

17 Apr 20250.94381

8 May 20250.94482

10 May 20250.94381

15 May 20250.9447

17 May 20250.94482

18 May 20250.94381

15 Jun 20250.9447

18 Jun 20250.94358

25 Jun 20250.9447

28 Jun 20250.94358

16 Jul 20250.9447

18 Jul 20250.94358

16 Aug 20250.9447

19 Aug 20250.94358

9 Sep 20250.9447

11 Sep 20250.94358

16 Sep 20250.9447

19 Sep 20250.94358

17 Oct 20250.9447

20 Oct 20250.94358

29 Oct 20250.9447

1 Nov 20250.94358

18 Nov 20250.94251

21 Nov 20250.9445

23 Nov 20250.94465

24 Nov 20250.94358

18 Dec 20250.9445

19 Dec 20250.94465

20 Dec 20250.94358

18 Jan 20260.94465

21 Jan 20260.94358

18 Feb 20260.9445

20 Feb 20260.94358

7 Mar 20260.9445

9 Mar 20260.94465

10 Mar 20260.94358

21 Mar 20260.9445

22 Mar 20260.94465

24 Mar 20260.94358

21 Apr 20260.9445

22 Apr 20260.94465

24 Apr 20260.94358

6 May 20260.9445

8 May 20260.94465

9 May 20260.94358

22 May 20260.9445

24 May 20260.94465

25 May 20260.94358

15 Jun 20260.99999

109 observations held. A highlighted step crossed a promotion threshold. A step marked with a scoring model moved because the instrument was replaced, not because the vulnerability changed. receipt

The full biography

Listed by CISA on the day it published, exploit probability more than doubled between 2021-12-13 and 2021-12-14 (0.18794 → 0.50253) and the record had been public for 4 years, 8 months when this index was last written.

No material movement in 81 days as of the last ingest this index recorded.

Public PoC 2021-12-09 receipt · Published 2021-12-10 receipt · CISA KEV 2021-12-10 receipt · Index as of 2026-09-04 derived

The pattern, elsewhere

CVE-2026-20131 · Cisco Secure Firewall Management Center (FMC)matches 8 of 10KEV listed · 2026receipt

CVE-2025-10035 · Fortra GoAnywhere MFTmatches 8 of 10KEV listed · 2025receipt

CVE-2025-55182 · Meta react-server-dom-webpackmatches 8 of 10KEV listed · 2025receipt

CVE-2023-40044 · Progress Software Corporation WS_FTP Servermatches 8 of 10KEV listed · 2023receipt

CVE-2023-46604 · Apache ActiveMQmatches 8 of 10KEV listed · 2023receipt

CVE-2023-43208matches 7 of 9KEV listed · 2023receipt

3512 records in this class held. The six above are ranked by exploit maturity, then recency.

Apache Struts OGNLexpression evaluation · 9 KEV-listed records

Spring Expression Languageexpression evaluation · 1 KEV-listed record

Freemarkerexpression evaluation · no KEV-listed records

Velocityexpression evaluation · no KEV-listed records

Thymeleafexpression evaluation · no KEV-listed records

logbackjava logging · no KEV-listed records

Listed for shared mechanism, not known vulnerability. Known records for each appear on its own page. taxonomy@v1

Siblings and hubs

Records related to this one

CVE-2021-3100 · its record cites this one CVE-2021-4104 · its record cites this one CVE-2021-4125 · its record cites this one CVE-2021-44530 · its record cites this one CVE-2021-45046 · its record cites this one CVE-2022-0070 · its record cites this one

Its defect family

apache software foundation apache log4j2

Of the 3 records in this family, this is the only one with public proof-of-concept code, and it holds 418 references to it.

CVE-2021-44832 CVE-2021-45105

Grouped by shared product and weakness, not by shared vulnerability. Each record's own state is on its own page.

Family membership: held values

The whole family, and what merged it

This record is one of a group, and the group's page describes all of them. This page is kept and dated, and the defect family's own page is the one we offer for indexing: the whole group.

Browse the index from here

Every CVE we hold for Apache Added to CISA KEV this week The whole index

These are index-wide views, not findings about CVE-2021-44228.

What usually comes next

Brief on CVE-2021-44228Held facts, dated and print-ready. Sign in to add the researched section.What else is past its CISA deadline?Every KEV listing we hold, by remediation date.Do we run Apache Log4j2?Match a product list against what we hold. Product names, not versions.

Everything above needs no account. What is below is work: assembling it, scoping it to your estate, watching it, and handing it to someone else.

Everything on this page is free. Public data. Withholding it protects nothing.