RetrospectiveExploited in the wildCRITICALCISA KEV

Log4Shell: Log4j 2 JNDI lookups gave unauthenticated RCE, exploited before disclosure

A single logged string let remote attackers run code through Apache Log4j 2. Exploitation began before disclosure in December 2021 and still turns up years later. Find every copy of log4j-core and move it to 2.17.1, 2.12.4 or 2.3.2.

Apache Software Foundation Apache Log4j 2 (log4j-core)CVE-2021-44228CVE-2021-45046CVSS10.0Libraries & supply chain
Published Oct 22, 2026 · Updated Oct 22, 2026

Probing seen from 2021-12-01, before public disclosure; miners, botnets, ransomware operators and state groups followed. CISA listed it in KEV on 2021-12-10 5,2,6.

Nov 24, 2021979 daysJul 30, 2024

What you need to know

  • Any application that logs attacker-supplied text with a vulnerable log4j-core 2.x (2.0-beta9 up to 2.15.0, apart from the 2.3.1 and 2.12.2 backports) can be made to load and run remote code, with no authentication.
  • Exploitation started before disclosure and spread within hours to miners, Mirai, Cobalt Strike, ransomware and nation-state groups.
  • The 2.15.0 fix was incomplete (CVE-2021-45046). Patching settled at 2.17.1 for Java 8+, 2.12.4 for Java 7 and 2.3.2 for Java 6.
  • Vulnerable versions still ship years later, and Log4Shell is still used for initial access, notably against VMware Horizon.
  • Hunt for new outbound LDAP, RMI and DNS connections from Java hosts, and look for lookup syntax in any logged field.

What's happening

CVE-2021-44228, known as Log4Shell, lets an unauthenticated attacker run code on any server where Apache Log4j 2 logs text that the attacker controls 1,8. Apache rates it CVSS 10.0. It affects log4j-core from 2.0-beta9 up to the 2.3.1, 2.12.2 and 2.15.0 fix lines 1. Log4j is a shared logging component built into a long list of products, including Struts2, Solr, Druid and Flink, so many organisations were exposed without knowing they ran it 4. Chen Zhaojun of Alibaba Cloud Security reported the bug to Apache on 2021-11-24 11.

Exploitation came first. Cloudflare saw limited probing on 2021-12-01, eight days before the 2021-12-09 disclosure, and its first post-disclosure attempt nine minutes later 5. GreyNoise saw scanning start on 2021-12-09 and jump on 2021-12-10 9. CISA added the flaw to KEV on 2021-12-10 with a 2021-12-24 due date 2. Coin miners were among the first to exploit it at scale 7. Talos and Microsoft reported Mirai, Cobalt Strike, Kinsing and Khonsari ransomware payloads 8,6. Microsoft named PHOSPHORUS (Iran), HAFNIUM (China) and DEV-0401, a China-based ransomware operator whose VMware Horizon intrusions led to NightSky 6. Mandiant reported evidence of exploitation by Chinese and Iranian state actors 7. The NCSC knew of compromises through VMware Horizon, MobileIron and Ubiquiti UniFi 3.

The problem has not gone away. The US Cyber Safety Review Board called Log4j an "endemic vulnerability" that is expected to stay in systems for a decade or more. It found no significant attacks on critical infrastructure tied to it 14. In December 2023, Veracode data showed about 2.8% of applications using Log4j still on Log4Shell-vulnerable versions and 32% on end-of-life 1.x 15. Talos attributed a 2023 campaign, Operation Blacksmith, to the Lazarus Group and reported that it used Log4Shell for initial access to public VMware Horizon servers 10. Datadog saw it used against a Confluence honeypot to drop XMRig in July 2024 16.

How it works

Log4j 2 supports lookups, which are placeholders that are resolved while a message is formatted. One of them is a JNDI lookup that can fetch objects from LDAP, RMI and similar services. Apache says these JNDI features did not guard against endpoints that an attacker controls. Anyone who can get a crafted string into a log message or parameter can therefore make Log4j load and run code from a remote LDAP server 1. Talos notes that this works in default configurations and needs no authentication 8.

Any field the application logs can carry the string, such as an HTTP header like User-Agent. Mandiant saw callbacks over LDAP, LDAPS, RMI and DNS, as well as nested lookups used to leak environment variables like cloud keys inside the callback hostname 7. Talos also saw lookup strings arrive in email, file metadata, OOXML templates and hidden web form fields. So exposure was not limited to internet-facing web services 8. Log4j 1.x has no lookups. It is exposed only when its configuration uses JNDI through a JMSAppender 1.

CVE-2021-45046 is a gap in the first fix. Apache says 2.15.0 remained exploitable in certain non-default configurations, namely a Pattern Layout that uses a Thread Context lookup 1. Apache first rated it 3.7 and later raised it to 9.0 11. The 2.16.0 release removed message lookups and turned JNDI off by default 12,13.

What to do

In order of priority
  1. 1

    Upgrade log4j-core to the final 2021 releases: 2.17.1 for Java 8+, 2.12.4 for Java 7 and 2.3.2 for Java 6, all published 2021-12-28. These also cover CVE-2021-44228 and CVE-2021-45046 4,1.

  2. 2

    For third-party products, follow each vendor's advisory, because Log4j is often bundled where you cannot patch it yourself 3.

  3. 3

    Where you cannot upgrade, remove JndiLookup.class from the log4j-core JAR and restart the JVM 7. Do not rely on the formatMsgNoLookups setting, which proved insufficient 4,7.

  4. 4

    For Log4j 1.x, check that no JMSAppender is configured and plan the migration to Log4j 2 1,3.

  5. 5

    Enforce deny-by-default egress from servers, including LDAP, LDAPS, RMI and DNS 7. Treat WAF rules as one layer only, because bypass variants were common 3,7.

  6. 6

    Assume breach on hosts that were exposed before patching. Remove coin miners and web shells, and rotate credentials stored in environment variables on affected servers 7.

Detection

  • Find every copy first. Search file systems for log4j-core-2.x.jar and JndiLookup.class, including inside EAR, JAR and WAR archives, and query package managers and SBOM tools such as syft 3,7.
  • In netflow or EDR data, look for internal hosts that open LDAP, LDAPS, RMI or DNS connections to external destinations not seen before 2021-12-10. Then check those hosts for Log4j and review their DNS queries for exfiltration 3.
  • Search web, WAF, email and application logs, process command lines and user-agent fields for the start of a ${jndi: lookup followed by a protocol such as ldap, rmi or dns 6. Cloudflare advises treating any lookup start sequence as suspicious, because attackers hid the keyword with case-changing, nested and default-value lookups 5.
  • On VMware Horizon, review child processes of ws_TomcatService.exe 6. Confirm callbacks to testing services such as interact.sh, canarytokens.org or dnslog.cn before treating them as hostile, because researchers used them too 6.
  • Network signatures exist: Talos published Snort SIDs 58722-58744, 58751 for SMTP vectors, 58784-58790, 58795, 58801-58814 and 300055-300058, plus ClamAV signatures for the exploit tools and miners 8.

Timeline

  1. Alibaba Cloud Security reports the flaw to Apache 11

  2. Cloudflare observes first limited exploitation attempts, before disclosure 5

  3. Log4j 2.15.0 released with the first fix 12

  4. Public disclosure; GreyNoise sees scanning begin 9

  5. CISA adds CVE-2021-44228 to KEV, due 2021-12-24 2

  6. Log4j 2.16.0 reported available: message lookups removed, JNDI off by default (CVE-2021-45046) 13

  7. CISA Emergency Directive 22-02 orders federal agencies to mitigate by 2021-12-23 7

  8. Java 7 and Java 6 branches get 2.12.3 and 2.3.1 4

  9. 2.17.1, 2.12.4 and 2.3.2 released, closing CVE-2021-44832 4

  10. Cyber Safety Review Board calls Log4j an endemic vulnerability 14

  11. Talos reports Lazarus Group's Operation Blacksmith used Log4Shell on VMware Horizon for initial access 10

  12. Datadog sees Log4Shell used against a Confluence honeypot to drop XMRig 16

Sources

  1. 1
    Security
    Apache Logging Services · Vendor
  2. 2
    CISA Adds 13 Known Exploited Vulnerabilities to Catalog
    CISA · Government · Dec 10, 2021
  3. 3
    Alert: Apache Log4j vulnerabilities
    NCSC UK · Government · Dec 10, 2021
  4. 4
    Active exploitation of Apache Log4j vulnerability - update 7
    Canadian Centre for Cyber Security · Government · Dec 10, 2021
  5. 5
    Exploitation of Log4j CVE-2021-44228 before public disclosure and evolution of evasion and exfiltration
    Cloudflare · Research · Dec 14, 2021
  6. 6
    Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability
    Microsoft Threat Intelligence · Research · Dec 11, 2021
  7. 7
    Log4Shell Initial Exploitation and Mitigation Recommendations
    Mandiant (Google Cloud) · Research · Dec 15, 2021
  8. 8
    Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild
    Cisco Talos · Research · Dec 10, 2021
  9. 9
    Trending: Apache Log4j Vulnerability
    GreyNoise · Research · Dec 10, 2021
  10. 10
    Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang
    Cisco Talos · Research · Dec 11, 2023
  11. 11
    All Log4j, logback bugs we know so far and why you MUST ditch 2.15
    BleepingComputer · News · Dec 17, 2021
  12. 12
    Problematic Log4j Functionality Disabled as More Security Issues Come to Light
    SecurityWeek · News · Dec 15, 2021
  13. 13
    Another fix: Apache emits Log4j 2.16 to tackle security bug
    The Register · News · Dec 14, 2021
  14. 14
    First Cyber Safety Review Board report finds Log4j has become an 'endemic vulnerability'
    The Record · News · Jul 14, 2022
  15. 15
    Two years on, 1 in 4 apps still vulnerable to Log4Shell
    The Register · News · Dec 11, 2023
  16. 16
    Two Years On, Log4Shell Vulnerability Still Being Exploited to Deploy Malware
    SecurityWeek · News · Aug 22, 2024

Corroborated by independent sources. Researched and drafted by the VulnDigest briefs agent from 16 sources, then checked against them by a separate review step on Oct 22, 2026.

Apache's security page could not be loaded at verification time. Fixed versions were checked against the NVD record for CVE-2021-45046, Mandiant's restatement of Apache's guidance and the UK and Canadian government advisories.

Sources disagree on the Java 7 fix for CVE-2021-45046 (2.12.2 per NVD and NCSC). Use 2.12.4, which is past both candidates.

The KEV date comes from CISA's 2021-12-10 alert. The KEV catalog entry itself was not loaded.

Spotted an error? Open an issue on sochub.io.