{"basis":"claimed","id":"CVE-2021-44228","name":"Apache Log4j2 Remote Code Execution Vulnerability","vendorProject":"Apache","product":"Log4j2","publishedAt":"2021-12-10","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2021-12-10","dueDate":"2021-12-24","ransomware":true},"epss":{"score":0.99999,"percentile":1,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"no_history","firstOn":null,"daysToRule":null},"aws":{"status":"rule","firstOn":"2021-12-10","daysToRule":0},"azure":{"status":"rule","firstOn":null,"daysToRule":null},"google":{"status":"rule","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"no_history","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"no_history","firstOn":null,"daysToRule":null}},"title":"Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","cwes":["CWE-502","CWE-400","CWE-20"],"vendors":[{"vendor":"cloudflare","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"rule","basis":"claimed","firstOn":"2021-12-10","firstIsNew":true,"daysToRule":0,"daysAtMost":null,"freePlan":false,"claims":[{"id":"d74041144b94ed88d1d3fbf90407c6a4512cb44c24606b26d9031152170339af","cve_id":"CVE-2021-44228","vendor":"aws","product":null,"rule_id":null,"rule_name":"Known bad inputs Log4JRCE BadAuthToken_COOKIE_AUTHORIZATION","change":"new","default_action":null,"published_on":"2021-12-10","source_url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","source_title":"AWS Managed Rules changelog","excerpt":"Known bad inputs Log4JRCE BadAuthToken_COOKIE_AUTHORIZATION: Added the rule Log4JRCE version 1.2 in response to the recently disclosed security issue within Log4j. For information see CVE-2021-44228 . This rule inspects common URI paths, query strings, the first 8KB of the request body, and common headers. The rule uses double URL_DECODE_UNI text transformations. Released version 1.3 of Log4JRCE to tune the matching criteria and to inspect additional headers. Removed the rule BadAuthToken_COOKI…","first_seen_at":"2026-11-02T21:00:18.042Z"}]},{"vendor":"azure","status":"rule","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[{"id":"bb537226e7e21eee66c4078cdc0519d0a6c066d3f5bfef23ea93f4f3d177a631","cve_id":"CVE-2021-44228","vendor":"azure","product":"Front Door WAF (DRS)","rule_id":"944240","rule_name":"Remote Command Execution: Java serialization and Log4j vulnerability (CVE-2021-44228, CVE-2021-45046)","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs","source_title":"Front Door WAF (DRS) rule groups and rules","excerpt":"Rule 944240: Critical - 5 · 2 · Remote Command Execution: Java serialization and Log4j vulnerability (CVE-2021-44228, CVE-2021-45046)","first_seen_at":"2026-11-02T21:00:19.031Z"},{"id":"47891b46f9bb9b82448a11df8d81ec7cbef7aead707014dbc2a582befb7fd58f","cve_id":"CVE-2021-44228","vendor":"azure","product":"Application Gateway WAF (DRS/CRS)","rule_id":"944240","rule_name":"Remote Command Execution: Java serialization and Log4j vulnerability (CVE-2021-44228, CVE-2021-45046)","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","source_title":"Application Gateway WAF (DRS/CRS) rule groups and rules","excerpt":"Rule 944240: Critical - 5 · 2 · Remote Command Execution: Java serialization and Log4j vulnerability (CVE-2021-44228, CVE-2021-45046)","first_seen_at":"2026-11-02T21:00:19.031Z"},{"id":"c8826d067d23b6680ff512b7c12ab5f2c3a970f020212d69285e4d8ee8bdbfac","cve_id":"CVE-2021-44228","vendor":"azure","product":"Application Gateway WAF (DRS/CRS)","rule_id":"800100","rule_name":"Rule to help detect and mitigate log4j vulnerability CVE-2021-44228, CVE-2021-45046","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","source_title":"Application Gateway WAF (DRS/CRS) rule groups and rules","excerpt":"Rule 800100: Critical - 5 · PL2 · Rule to help detect and mitigate log4j vulnerability CVE-2021-44228, CVE-2021-45046","first_seen_at":"2026-11-02T21:00:19.183Z"}]},{"vendor":"google","status":"rule","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[{"id":"5d847f5122a27c26cfdf612bd5365b95417f9ea5aa1ac432d2ba5d6afca28541","cve_id":"CVE-2021-44228","vendor":"google","product":"Cloud Armor preconfigured rules","rule_id":"owasp-crs-v030001-id044228-cve","rule_name":"Base rule to help detect exploit attempts of CVE-2021-44228 & CVE-2021-45046","change":"listed","default_action":null,"published_on":null,"source_url":"https://docs.cloud.google.com/armor/docs/waf-rules","source_title":"Cloud Armor preconfigured WAF rules","excerpt":"Signature owasp-crs-v030001-id044228-cve (sensitivity 1): Base rule to help detect exploit attempts of CVE-2021-44228 & CVE-2021-45046","first_seen_at":"2026-11-02T21:00:21.696Z"}]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-04T04:17:39.642Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"kevAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","kevNotes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","references":[{"url":"https://logging.apache.org/log4j/2.x/security.html","name":null,"tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/1","name":"[oss-security] 20211210 CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/2","name":"[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints","tags":["mailing-list"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","name":"20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/3","name":"[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints","tags":["mailing-list"]},{"url":"https://security.netapp.com/advisory/ntap-20211210-0007/","name":null,"tags":[]},{"url":"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","name":null,"tags":[]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","name":null,"tags":[]},{"url":"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","name":null,"tags":[]},{"url":"https://www.debian.org/security/2021/dsa-5020","name":"DSA-5020","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html","name":"[debian-lts-announce] 20211212 [SECURITY] [DLA 2842-1] apache-log4j2 security update","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/","name":"FEDORA-2021-f0f501d01f","tags":["vendor-advisory"]},{"url":"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/","name":"Microsoft’s Response to CVE-2021-44228 Apache Log4j 2","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/13/2","name":"[oss-security] 20211213 Re: CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/13/1","name":"[oss-security] 20211213 CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/14/4","name":"[oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack","tags":["mailing-list"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","name":"20211210 A Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021","tags":["vendor-advisory"]},{"url":"https://www.kb.cert.org/vuls/id/930724","name":"VU#930724","tags":["third-party-advisory"]},{"url":"https://twitter.com/kurtseifried/status/1469345530182455296","name":null,"tags":[]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","name":null,"tags":[]},{"url":"http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html","name":null,"tags":[]},{"url":"http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","name":null,"tags":[]},{"url":"http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html","name":null,"tags":[]},{"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","name":null,"tags":[]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","name":"20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/15/3","name":"[oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack","tags":["mailing-list"]},{"url":"http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html","name":null,"tags":[]},{"url":"http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html","name":null,"tags":[]},{"url":"http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html","name":null,"tags":[]},{"url":"http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html","name":null,"tags":[]},{"url":"http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html","name":null,"tags":[]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","name":null,"tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/","name":"FEDORA-2021-66d6c484f3","tags":["vendor-advisory"]},{"url":"http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html","name":null,"tags":[]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","name":null,"tags":[]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","name":null,"tags":[]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","name":null,"tags":[]},{"url":"http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html","name":null,"tags":[]},{"url":"https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md","name":null,"tags":[]},{"url":"http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html","name":null,"tags":[]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Log4j2","affected":["2.0-beta9 and later"],"fixed":["2.3.1","2.12.2","2.15.0"]}],"briefing":{"status":{"id":"known_exploited","label":"Known exploited"},"why":"CISA lists CVE-2021-44228 as exploited in the wild since 2021-12-10, including known use in ransomware campaigns. It is reachable over the network without credentials or any user interaction (CVSS 10.0). A Metasploit module exists, so exploitation needs no custom work. In our benchmark, 6 of 6 WAF configurations stopped every variant of the public exploit.","who":"Teams running Apache Software Foundation Apache Log4j2 (2.0-beta9 and later). Prioritise internet-facing instances.","what_to_do":[{"text":"Find the version you run. On the host (Log4j jars in use):","command":{"where":"On the host (Log4j jars in use)","command":"find / -name 'log4j-core-*.jar' 2>/dev/null"}},{"text":"Update to a fixed version (Apache Log4j2 2.3.1, Apache Log4j2 2.12.2 and Apache Log4j2 2.15.0) using the vendor's guidance.","href":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","linkText":"20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021"},{"text":"CISA's required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available. US federal agencies must act by 2021-12-24."},{"text":"Review exposed instances for signs of compromise: it was exploited before many systems were patched, and a later patch does not undo access already gained."},{"text":"Keep a WAF rule in place while you patch: AWS, Microsoft Azure and Google Cloud ship rules you may need to switch on. A WAF rule reduces exposure; it does not replace the patch.","href":"#edge","linkText":"Edge coverage"},{"text":"Check which WAF sits in front of your site and whether it covers this CVE.","href":"#check","linkText":"Check your domain"}],"evidence":[{"heading":"CVE record","text":"CVSS 3.1 10.0 (critical). Weakness: CWE-502, CWE-400, CWE-20.","links":[{"label":"CVE-2021-44228","href":"https://www.cve.org/CVERecord?id=CVE-2021-44228"},{"label":"NVD","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228"}]},{"heading":"Vendor advisory","text":"Fixes and mitigations the CVE record links to. Check affected builds against the vendor, including backports.","links":[{"label":"20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021","href":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"},{"label":"DSA-5020","href":"https://www.debian.org/security/2021/dsa-5020"},{"label":"FEDORA-2021-f0f501d01f","href":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/"},{"label":"Microsoft’s Response to CVE-2021-44228 Apache Log4j 2","href":"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/"}]},{"heading":"Exploit evidence","text":"Metasploit has a module. Exploit-DB lists 3 exploits. A nuclei template exists, which our lab and benchmark replay.","links":[{"label":"Metasploit: MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell)","href":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/mobileiron_core_log4shell.rb"},{"label":"Metasploit: Log4Shell HTTP Scanner","href":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/log4shell_scanner.rb"},{"label":"Exploit-DB: AD Manager Plus 7122 - Remote Code Execution (RCE)","href":"https://www.exploit-db.com/exploits/51183"},{"label":"Exploit-DB: Apache Log4j 2 - Remote Code Execution (RCE)","href":"https://www.exploit-db.com/exploits/50592"}]},{"heading":"Seen exploited","text":"Honeypots recorded exploitation attempts on 86 days between 4 Aug 2026 and 2 Nov 2026. Listed in an independent exploited-vulnerability catalog on 3 Sept 2026. Claimed in 72 Telegram posts (unverified).","links":[]},{"heading":"CISA KEV","text":"Added 2021-12-10, federal due date 2021-12-24, known ransomware use (catalog 2026.11.03, checked 2026-11-04).","links":[{"label":"CISA KEV catalog","href":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44228"}]},{"heading":"EPSS","text":"99.9% probability of exploitation activity in the next 30 days, higher than 100% of CVEs (2026-11-02).","links":[{"label":"FIRST EPSS","href":"https://api.first.org/data/v1/epss?cve=CVE-2021-44228"}]},{"heading":"WAF vendor statements","text":"AWS, Microsoft Azure and Google Cloud name it in a changelog. Quotes and dates below.","links":[{"label":"Vendor statements","href":"#evidence"}]},{"heading":"Measured","text":"6 of 6 WAF configurations stopped every variant of the public exploit in our daily benchmark.","links":[{"label":"WAF benchmark","href":"/bench"}]}],"agent_prompt":"Assess whether the infrastructure available to you is affected by CVE-2021-44228 (Apache Log4j2 Remote Code Execution Vulnerability). Perform a read-only assessment within your authorized access. Do not send exploit traffic, scan third-party systems, change configuration or restart services.\n\n1. Verify the CVE record at https://www.cve.org/CVERecord?id=CVE-2021-44228 and the vendor advisories (https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd, https://www.debian.org/security/2021/dsa-5020, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/). Establish affected and fixed versions, including vendor backports. The record lists: Apache Software Foundation Apache Log4j2: affected 2.0-beta9 and later; fixed 2.3.1; 2.12.2; 2.15.0. Cite sources and retrieval dates; flag anything you cannot verify.\n2. Inventory deployments of Apache Log4j2: asset, environment, owner where known, installed version or build, and how you confirmed it (package metadata, a version endpoint, image tags), e.g. `find / -name 'log4j-core-*.jar' 2>/dev/null` (on the host (Log4j jars in use)). An image tag alone does not prove the running version.\n3. Identify which deployments are reachable from the internet or untrusted networks, and through which paths (direct origin, load balancer, CDN or WAF).\n4. Assess compensating controls separately from patch status. Current edge WAF coverage for this CVE: AWS: rule exists, check whether it is enabled; Microsoft Azure: rule exists, check whether it is enabled; Google Cloud: rule exists, check whether it is enabled. Live data: https://cve.vigilbase.com/api/v1/cves/CVE-2021-44228. Check whether the rule is enabled and in block mode on each path, and whether any path bypasses the WAF. A WAF rule is not a patch.\n5. It is known exploited (CISA KEV): review logs on exposed instances for signs of exploitation before and after patching.\n\nReturn a short summary and a table: asset | version/build | assessment (affected, fixed, not applicable, unknown) | exposure | compensating control | evidence | next action. List what you could not assess and the access needed to resolve it. Do not infer absence of compromise from patch status or a lack of alerts.\n\nRemediation guidance: Update to a fixed version (Apache Log4j2 2.3.1, Apache Log4j2 2.12.2 and Apache Log4j2 2.15.0) using the vendor's guidance. CISA's required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available. US federal agencies must act by 2021-12-24.\nMore: https://cve.vigilbase.com/cve/CVE-2021-44228"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-03T22:44:42.000Z","verdict":"blocked","templateId":"CVE-2021-44228","templatePath":"http/cves/2021/CVE-2021-44228.yaml","requests":2,"blockedRequests":2,"rules":["920600","932130","932160","932235","932380","933135","944150"],"note":"","requestDetail":[{"method":"GET","path":"/?…","status":403,"blocked":true,"rules":["932130","932160","932235","932380","933135","944150"]},{"method":"GET","path":"/","status":403,"blocked":true,"rules":["920600","932130","932160","932235","932380","933135"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-03T22:44:42.000Z","verdict":"blocked","templateId":"CVE-2021-44228","templatePath":"http/cves/2021/CVE-2021-44228.yaml","requests":2,"blockedRequests":2,"rules":["920600","931130","932130","932131","932160","932161","932235","932236","932239","932380","933135","942430","944150","944151"],"note":"","requestDetail":[{"method":"GET","path":"/?…","status":403,"blocked":true,"rules":["931130","932130","932160","932235","932236","932380"]},{"method":"GET","path":"/","status":403,"blocked":true,"rules":["920600","932130","932131","932160","932161","932235"]}]}],"sightings":{"honeypot":{"days":86,"first":"2026-08-04","last":"2026-11-02"},"catalog":"2026-09-03","reports":[],"telegram":{"posts":72,"last":"2026-11-02"},"days":{"honeypot":["2026-08-04","2026-08-05","2026-08-09","2026-08-10","2026-08-11","2026-08-12","2026-08-13","2026-08-14","2026-08-15","2026-08-16","2026-08-17","2026-08-18","2026-08-19","2026-08-20","2026-08-21","2026-08-22","2026-08-23","2026-08-24","2026-08-25","2026-08-26","2026-08-27","2026-08-28","2026-08-29","2026-08-30","2026-08-31","2026-09-01","2026-09-02","2026-09-03","2026-09-04","2026-09-05","2026-09-06","2026-09-07","2026-09-09","2026-09-10","2026-09-11","2026-09-12","2026-09-13","2026-09-14","2026-09-15","2026-09-16","2026-09-17","2026-09-18","2026-09-19","2026-09-20","2026-09-21","2026-09-22","2026-09-23","2026-09-24","2026-09-25","2026-09-26","2026-09-27","2026-09-28","2026-09-29","2026-09-30","2026-10-01","2026-10-02","2026-10-03","2026-10-04","2026-10-05","2026-10-06","2026-10-07","2026-10-08","2026-10-09","2026-10-10","2026-10-11","2026-10-12","2026-10-13","2026-10-14","2026-10-15","2026-10-16","2026-10-17","2026-10-18","2026-10-19","2026-10-20","2026-10-21","2026-10-22","2026-10-23","2026-10-25","2026-10-26","2026-10-27","2026-10-28","2026-10-29","2026-10-30","2026-10-31","2026-11-01","2026-11-02"],"reports":[],"telegram":["2026-08-06","2026-08-09","2026-08-10","2026-08-12","2026-08-15","2026-08-16","2026-08-19","2026-08-23","2026-08-28","2026-08-29","2026-09-02","2026-09-03","2026-09-05","2026-09-06","2026-09-07","2026-09-09","2026-09-10","2026-10-08","2026-10-18","2026-10-21","2026-10-23","2026-10-27","2026-11-01","2026-11-02"]}},"social":{"total":7,"first_seen":"2026-11-02T22:42:14.000Z","daily":[{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":1},{"day":"2026-11-03","posts":6},{"day":"2026-11-04","posts":0}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/exploitgrid/status/2117653366486831420","author":"exploitgrid","author_name":"ExploitGrid","avatar_url":"https://pbs.twimg.com/profile_images/2105967313266835456/lquvvasd_bigger.jpg","text":"💀 CRITICAL Exploits Trending (all CVSS 10)\n├ CVE-2021-27466 + CVE-2021-27460 · FactoryTalk AssetCentre · RCE listing live\n└ CVE-2021-44228 · Log4Shell · 4 more audit resources live","engagement":0,"posted_at":"2026-11-03T16:21:21.000Z"},{"source":"x","kind":"post","url":"https://x.com/exploitgrid/status/2117632618782953896","author":"exploitgrid","author_name":"ExploitGrid","avatar_url":"https://pbs.twimg.com/profile_images/2105967313266835456/lquvvasd_bigger.jpg","text":"[EXPLOIT] CVE-2021-44228 [CRITICAL/PoC]\nCVSS: 10 | Vendor: #ApacheSoftwareFoundation\n\nlog4shell-audit-20\n\n🔗 https://t.co/ZUodQKAp7p","engagement":0,"posted_at":"2026-11-03T14:58:54.000Z"},{"source":"x","kind":"post","url":"https://x.com/exploitgrid/status/2117632615629103149","author":"exploitgrid","author_name":"ExploitGrid","avatar_url":"https://pbs.twimg.com/profile_images/2105967313266835456/lquvvasd_bigger.jpg","text":"[EXPLOIT] CVE-2021-44228 [CRITICAL/PoC]\nCVSS: 10 | Vendor: #ApacheSoftwareFoundation\n\nlog4shell-audit2\n\n🔗 https://t.co/AdUKbWqMFx","engagement":0,"posted_at":"2026-11-03T14:58:53.000Z"},{"source":"x","kind":"post","url":"https://x.com/exploitgrid/status/2117632611434877415","author":"exploitgrid","author_name":"ExploitGrid","avatar_url":"https://pbs.twimg.com/profile_images/2105967313266835456/lquvvasd_bigger.jpg","text":"[EXPLOIT] CVE-2021-44228 [CRITICAL/PoC]\nCVSS: 10 | Vendor: #ApacheSoftwareFoundation\n\nlog4shell-audit-followup\n\n🔗 https://t.co/vjNbS5Jatx","engagement":0,"posted_at":"2026-11-03T14:58:52.000Z"},{"source":"x","kind":"post","url":"https://x.com/exploitgrid/status/2117632606959223226","author":"exploitgrid","author_name":"ExploitGrid","avatar_url":"https://pbs.twimg.com/profile_images/2105967313266835456/lquvvasd_bigger.jpg","text":"[EXPLOIT] CVE-2021-44228 [CRITICAL/PoC]\nCVSS: 10 | Vendor: #ApacheSoftwareFoundation\n\nlog4shell-audit-2025\n\n🔗 https://t.co/GLYQoKA5j9","engagement":0,"posted_at":"2026-11-03T14:58:51.000Z"},{"source":"x","kind":"post","url":"https://x.com/exploitgrid/status/2117632598906442026","author":"exploitgrid","author_name":"ExploitGrid","avatar_url":"https://pbs.twimg.com/profile_images/2105967313266835456/lquvvasd_bigger.jpg","text":"ExploitGrid Daily Digest\n\n🚨 Top Exploits:\nCVE-2021-27466, CVE-2021-27460 (CVSS: 10)\nCVE-2021-44228 (CVSS: 10) Apache Softw...\nCVE-2021-44228 (CVSS: 10) Apache Softw...\nCVE-2021-44228 (CVSS: 10) Apache Softw...\nCVE-2021-44228 (CVSS: 10) Apache Softw...\n\n..🧵👇","engagement":0,"posted_at":"2026-11-03T14:58:49.000Z"},{"source":"x","kind":"post","url":"https://x.com/AssurePort/status/2117386833717760173","author":"AssurePort","author_name":"Assure Port","avatar_url":"https://pbs.twimg.com/profile_images/2117385535928885248/Dh40hmr__bigger.jpg","text":"Log4Shell (CVE-2021-44228) — 4 years old, still exploited in the wild.\nCVSS 10.0. One crafted log line → remote code execution via JNDI/LDAP in Log4j2.\nIf you don't know every service that bundles Log4j, you can't call yourself safe.\n#CVE #InfoSec #ThreatIntel #CyberSecurity","engagement":0,"posted_at":"2026-11-02T22:42:14.000Z"}],"exploit_repositories":[]}}