Vigilbase CVEConnect your agent

Apache Log4j2 Remote Code Execution Vulnerability

Exploited · KEV 2021-12-10RansomwareMetasploit moduleCVE-2021-44228CWE-502CWE-400

Exploited since 2021-12-10. 3 of 8 rule sources name it. Our CRS test: blocked.

Edge rules
3/8
Our test
Blocked
CVSS
10.0
EPSS
100.0% Top 0.1%
Posts, 14d
12026-10-21: 0 posts2026-10-22: 0 posts2026-10-23: 0 posts2026-10-24: 0 posts2026-10-25: 0 posts2026-10-26: 0 posts2026-10-27: 0 posts2026-10-28: 0 posts2026-10-29: 0 posts2026-10-30: 0 posts2026-10-31: 0 posts2026-11-01: 0 posts2026-11-02: 1 posts2026-11-03: 0 posts
Published
2021-12-10
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related… More

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Ask Vigil

AI · answers from this page
Ask about CVE-2021-44228: who's covered, what to patch first, how vendors compare. I cite sources and won't help with attacks.

Workers AI (Llama 3.3). Can be wrong: check the cited source.

Severity, decoded

CVSS 3.1
Critical · 10.0 / 10

Exploitable over the network, with no privileges and no user interaction, leading to full loss of confidentiality, integrity and availability, and the impact can reach components beyond the vulnerable one.

Over the internetNo login neededNo user actionWorks reliablySpreads beyond the appFull compromise
How the score is built8 metrics
  • Attack vectorAn attacker can reach it over the internet; no access to your network needed.
    Network
  • Attack complexityNo special conditions are needed; the attack works reliably.
    Low
  • Privileges requiredNo account or login is needed.
    None
  • User interactionNo one has to click or open anything; the attack works on its own.
    None
  • ScopeThe attack can spread beyond the vulnerable component to other parts of the system.
    Changed
  • Confidentiality impactAn attacker can read all data the affected component holds, or the most sensitive parts of it.
    High
  • Integrity impactAn attacker can change any data or files the affected component protects.
    High
  • Availability impactAn attacker can take the component down completely or keep it from serving anyone.
    High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA's assessmentSSVC, from the CVE record
ExploitationActive

Attackers are exploiting this in the wild.

AutomatableYes

Attackers can script the attack end to end and hit many targets at once.

Technical impactTotal

A successful attack gives full control over the affected software or all of its data.

Public exploits

9 found
5 Metasploit3 Exploit-DB1 Scanner template0 GitHub PoCs

Links are to third-party code: never run it outside an isolated lab.

Timeline

  1. 2021-12-09
    Metasploit module published
    Log4Shell HTTP Scanner
  2. 2021-12-10
    CVE published
    CVE List
  3. 2021-12-10
    Added to CISA KEV
    Confirmed exploitation in the wild
  4. 2021-12-10
    AWS ships a rule
    Known bad inputs Log4JRCE BadAuthToken_COOKIE_AUTHORIZATION
  5. 2021-12-14
    Exploit published on Exploit-DB
    Apache Log4j 2 - Remote Code Execution (RCE)
  6. 2026-11-02
    First social mention we saw
  7. 2026-11-02
    Our test: OWASP Core Rule Set blocked it
    paranoia level 1, anomaly threshold 5, default CRS settings
  8. 2026-11-02
    Our test: OWASP Core Rule Set blocked it
    paranoia level 2, anomaly threshold 5, default CRS settings

Social

2026-10-21: 0 posts2026-10-22: 0 posts2026-10-23: 0 posts2026-10-24: 0 posts2026-10-25: 0 posts2026-10-26: 0 posts2026-10-27: 0 posts2026-10-28: 0 posts2026-10-29: 0 posts2026-10-30: 0 posts2026-10-31: 0 posts2026-11-01: 0 posts2026-11-02: 1 posts2026-11-03: 0 posts

Top posts

  • Assure Port@AssurePort·

    Log4Shell (CVE-2021-44228) — 4 years old, still exploited in the wild. CVSS 10.0. One crafted log line → remote code execution via JNDI/LDAP in Log4j2. If you don't know every service that bundles Log4j, you can't call yourself safe. #CVE #InfoSec #ThreatIntel #CyberSecurity

    View on X

Vendor statements

Quoted
CloudflareWAF Managed RulesBefore feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.

AWSAWS WAF Managed Rules1 quoteRule published

First rule 2021-12-10, the day the CVE was published.

2021-12-10New ruleSource
Known bad inputs Log4JRCE BadAuthToken_COOKIE_AUTHORIZATION: Added the rule Log4JRCE version 1.2 in response to the recently disclosed security issue within Log4j. For information see CVE-2021-44228 . This rule inspects common URI paths, query strings, the first 8KB of the request body, and common headers. The rule uses double URL_DECODE_UNI text transformations. Released version 1.3 of Log4JRCE to tune the matching criteria and to inspect additional headers. Removed the rule BadAuthToken_COOKI…
Microsoft AzureFront Door and Application Gateway WAF (DRS)2 quotesRule published
UndatedListed944240Source
Rule 944240: Critical - 5 · 2 · Remote Command Execution: Java serialization and Log4j vulnerability (CVE-2021-44228, CVE-2021-45046)
UndatedListed800100Source
Rule 800100: Critical - 5 · PL2 · Rule to help detect and mitigate log4j vulnerability CVE-2021-44228, CVE-2021-45046
Google CloudCloud Armor preconfigured WAF rules1 quoteRule published
UndatedListed…4228-cveSource
Signature owasp-crs-v030001-id044228-cve (sensitivity 1): Base rule to help detect exploit attempts of CVE-2021-44228 & CVE-2021-45046
FastlyNext-Gen WAF virtual patchesBefore feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.

F5Attack signatures (Distributed Cloud WAF)Before feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.

AkamaiApp & API Protector (Adaptive Security Engine)No public source

This vendor publishes no machine-readable rule changelog we can check.

OWASP CRSCore Rule Set (open source, used inside many WAFs)Before feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.