No source can show you its own past. This one can.
Print this page to keep the view as it stands on this date. Everything hidden behind a disclosure opens, and every receipt prints with its value.
Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
CVE-2021-448324 of 4 sources documented this
rank 60 = 30 + 17 + 3 + 10 + 0
rank@v1 · this cycle
Someone is already using it
CISA KEV catalog · public proof-of-concept · FIRST EPSS
EPSS 0.97906 · without this subject the record ranks 30
What it costs you if it fires
NVD CVSS base score, then the CNA's own
CVSS 6.6, from NVD · without this subject the record ranks 43
It is getting worse, not staying still
FIRST EPSS series, rescorings and bad loads removed
rose on 2025-08-04 · without this subject the record ranks 57
How much of the world it touches
NVD CPE configurations
20 products in the CPE ranges · without this subject the record ranks 50
Someone else already set the date
CISA KEV remediation due date
no CISA due date · without this subject the record ranks 60
Unaudited dollar value2 of 3 inputs carry a receipt
Exposure$4.89Mover the next 30 days, if this record is yours
Movement+$916,000on 2026-03-04, the last material move, 3 months before this reading
Basisassumeda published average, not your estate
$4.89M = $4.99M incident cost x 1 exposure x 0.97906 likelihood
udv@v1 · unaudited · wrong for you until you say what you run
$4.99M is the cost of a breach that happened, from IBM Cost of a Data Breach Report 2026, global average. It is not the value of any asset of yours. That average already covers breaches of every severity, so scaling it by exposure understates a partial-impact record. That is an assumption, not a measurement. Your own asset value goes in the decision record.
RISINGRisen from 0.02278 to 0.97906 across 88 observations. arc-rules@v1
Foresight · where to check next
log4j2 is one instance of CWE-20, improper input validation. The index holds 13347 prior instances of this class, 73 KEV-listed. 6 neighbors share the mechanism; each carries its own record state. taxonomy@v1
Listed for shared mechanism, not known vulnerability.
Color is a claim, not decoration:the hostile worldthe defenseno signal
Running Apache Log4j2? Check your version
A deterministic range check against the ranges this record publishes. It tells you where a version sits in the record, not whether your deployment is exploitable. No account needed.
Watch this record
Matches your own product list against every record this index holds, and tells you when one of them moves.
Choose your verdict, then sign in or use an email link. Your first 100 records are free. Evidence is frozen when the record is created.
Private to your organization unless you share it. Put the proof link in your ticket so a reviewer can inspect the basis for your call. See how decision records work.
Harm, if it fires from the vector and the weakness
Written for the ticket you're about to file.
Reachnetwork-reachable · high privileges required · no user interaction · high attack complexityreceipt
ImpactComplete confidentiality, integrity and availability lossreceipt
Weakness classCWE-20 Improper Input Validation; CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')receipt
Published consequencesCWE-20: Availability: DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory); Confidentiality: Read Memory, Read Files or Directories…[email protected]
CISA KEV & Federal Remediation Deadline from the record and CISA
Patch available sinceNo dated patch-availability record in held sources. The index holds reference URLs without dates and only the current revision of the CVE record, so the day a fix first existed cannot be derived. Only the versions it landed in.
Exploit Status & Known PoCs a ladder, not a score
Current rung: Proof-of-concept published · 2 public repositories, 2021-12-29.
RUNG 1Nothing observed in held sources
RUNG 2Proof-of-concept published · 2 public repositories2021-12-29receipt
A rung lights from a row in the index, never from an assessment. "Held sources" is the true scope of the claim: this index reads the CVE record, NVD, CISA KEV, FIRST's EPSS and public proof-of-concept repositories, and it does not observe attacks.
What it is stated by the CNA
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. receipt
NVD's analysis a second authority
severity
6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
weakness
CWE-20; CWE-74
affected versions
apache log4j >= 2.0.1 < 2.3.2; apache log4j >= 2.4 < 2.12.4; apache log4j >= 2.13.0 < 2.17.1; and 17 more, listed in full below
7 Mar 20230.07198 · crossed 0.10 and 0.50 · scoring model v2023.03.01
17 Mar 20250.46605 · crossed 0.10 · scoring model v2025.03.14
19 Mar 20250.79696 · crossed 0.50
20 Mar 20250.46605 · crossed 0.50
27 Mar 20250.79696 · crossed 0.50
28 Mar 20250.46605 · crossed 0.50
29 Mar 20250.79696 · crossed 0.50
30 Mar 20250.46605 · crossed 0.50
15 Apr 20250.27336
17 Apr 20250.44886
22 Apr 20250.52375 · crossed 0.50
30 Apr 20250.44886 · crossed 0.50
1 May 20250.27219
4 May 20250.44886
1 Jun 20250.29161
4 Jun 20250.43897
18 Jun 20250.52375 · crossed 0.50
23 Jun 20250.43837 · crossed 0.50
1 Jul 20250.29161
4 Jul 20250.43837
4 Aug 20250.53591 · crossed 0.50
1 Sep 20250.35225 · crossed 0.50
4 Sep 20250.50384 · crossed 0.50
1 Oct 20250.35225 · crossed 0.50
4 Oct 20250.53591 · crossed 0.50
1 Nov 20250.35225 · crossed 0.50
4 Nov 20250.50384 · crossed 0.50
18 Nov 20250.91348 · crossed 0.90
21 Nov 20250.50384 · crossed 0.90
1 Dec 20250.35225 · crossed 0.50
4 Dec 20250.50384 · crossed 0.50
1 Jan 20260.35225 · crossed 0.50
4 Jan 20260.53591 · crossed 0.50
1 Feb 20260.35225 · crossed 0.50
4 Feb 20260.53591 · crossed 0.50
1 Mar 20260.35225 · crossed 0.50
4 Mar 20260.53591 · crossed 0.50
15 Jun 20260.98078 · crossed 0.90 · scoring model v2026.06.15
23 Jun 20260.97906
This score more than doubled inside 72 hours. Both observations are in the full history below.
Show all 88 observations
29 Dec 20210.02278
30 Dec 20210.27437
6 Jan 20220.36259
7 Jan 20220.38745
4 Feb 20220.68637
7 Mar 20230.07198
22 Mar 20230.06697
1 May 20230.09463
8 May 20230.05338
28 May 20230.06081
8 Jul 20230.05112
21 Jul 20230.04084
5 Aug 20230.04276
19 Aug 20230.04690
17 Oct 20230.03957
31 Oct 20230.03368
8 Nov 20230.02687
27 Nov 20230.02602
13 Dec 20230.02767
11 Jan 20240.03050
7 Feb 20240.02504
18 Apr 20240.02239
3 Dec 20240.02126
16 Dec 20240.01916
17 Dec 20240.01401
14 Jan 20250.01583
30 Jan 20250.01664
17 Mar 20250.46605
19 Mar 20250.79696
20 Mar 20250.46605
27 Mar 20250.79696
28 Mar 20250.46605
29 Mar 20250.79696
30 Mar 20250.46605
13 Apr 20250.44886
15 Apr 20250.27336
17 Apr 20250.44886
22 Apr 20250.52375
30 Apr 20250.44886
1 May 20250.27219
4 May 20250.44886
5 May 20250.41604
9 May 20250.41664
14 May 20250.43897
28 May 20250.46339
1 Jun 20250.29161
4 Jun 20250.43897
8 Jun 20250.47122
18 Jun 20250.52375
23 Jun 20250.43837
1 Jul 20250.29161
4 Jul 20250.43837
27 Jul 20250.47122
1 Aug 20250.35225
4 Aug 20250.53591
16 Aug 20250.50384
1 Sep 20250.35225
4 Sep 20250.50384
12 Sep 20250.53591
1 Oct 20250.35225
4 Oct 20250.53591
17 Oct 20250.50384
1 Nov 20250.35225
4 Nov 20250.50384
14 Nov 20250.53591
18 Nov 20250.91348
21 Nov 20250.50384
23 Nov 20250.55534
26 Nov 20250.52774
1 Dec 20250.35225
4 Dec 20250.50384
6 Dec 20250.52774
17 Dec 20250.50384
30 Dec 20250.53591
1 Jan 20260.35225
4 Jan 20260.53591
1 Feb 20260.35225
4 Feb 20260.53591
1 Mar 20260.35225
4 Mar 20260.53591
21 Mar 20260.53648
13 Apr 20260.50589
14 Apr 20260.53648
1 May 20260.50443
20 May 20260.53648
4 Jun 20260.53591
15 Jun 20260.98078
23 Jun 20260.97906
88 observations held. A highlighted step crossed a promotion threshold. A step marked with a scoring model moved because the instrument was replaced, not because the vulnerability changed. receipt
The full biography
Exploit probability more than doubled between 2021-12-29 and 2021-12-30 (0.02278 → 0.27437) and the record had been public for 4 years, 5 months when this index was last written.
Published 2021-12-28 receipt · Public PoC 2021-12-29 receipt · Index as of 2026-06-23 derived
The pattern, elsewhere
log4j2 is one instance of CWE-20, improper input validation. The index holds 13347 prior instances of this class, 73 KEV-listed. 6 neighbors share the mechanism; each carries its own record state. [email protected]
CVE-2017-0148 · Microsoft Corporation Windows SMBmatches 7 of 10KEV listed · 2017receipt
This record is one of a group, and the group's page describes all of them. This page is kept and dated, and the defect family's own page is the one we offer for indexing: the whole group.