{"schema_version":"1","data":[{"id":2958,"advisory_id":"85af4e12-8f84-4c8c-b975-3497148f7df6","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44228","source_published_at":"2021-12-10T00:00:00+00:00","published_at":"2026-10-24T21:26:51.117734+00:00","extraction_method":"structured","technologies":["core-kev","log4j2"],"cve_ids":["CVE-2021-44228"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Log4j2 Remote Code Execution Vulnerability","summary":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. CISA required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","evidence":"kev:CVE-2021-44228","products":[{"name":{"value":"Log4j2","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-44228","aliases":["CVE-2021-44228"],"affected":[],"modified":"2021-12-10T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20","CWE-400","CWE-502"],"cveID":"CVE-2021-44228","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","dueDate":"2021-12-24","product":"Log4j2","dateAdded":"2021-12-10","vendorProject":"Apache","requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","known_exploited":true,"shortDescription":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","vulnerabilityName":"Apache Log4j2 Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-44228","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false}],"next_after":2958,"next_before":2958}