Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability

100
Patch now
CRITICAL 10.0EXPLOITEDREMOTEWATCHLISTUPGRADEUPGRADEUPGRADE

CVE-2021-44228 is a critical-severity flaw (CVSS 10.0) affecting 6bk1602-0aa12-0tp0 firmware, 6bk1602-0aa22-0tp0 firmware, 6bk1602-0aa32-0tp0 firmware, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been d

Why this priority

  • Critical severity
  • EPSS top 1%: very likely to be exploited
  • Exploited in the wild (CISA KEV)
  • Used in ransomware campaigns
  • Public exploit reference
  • CISA SSVC: automatable with total technical impact
  • Remotely exploitable, no login, no user action
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score10.0 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance100.0% (top 1%)
CISA exploited listYes, fix due 2021-12-24, used in ransomware
WeaknessCWE-20, CWE-400, CWE-502, CWE-917
Published2021-12-10
Last modified2026-08-11
Publisher (CNA): Apache Software Foundation · Vendor: apache · siemens

Share: LinkedIn · X · Reddit

Last updated 2026-08-11 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

siemens 6bk1602-0aa12-0tp0 firmware UPGRADE
Affected: < 2.7.0
Fixed in: 2.7.0
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
siemens 6bk1602-0aa22-0tp0 firmware UPGRADE
Affected: < 2.7.0
Fixed in: 2.7.0
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
siemens 6bk1602-0aa32-0tp0 firmware UPGRADE
Affected: < 2.7.0
Fixed in: 2.7.0
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
siemens 6bk1602-0aa42-0tp0 firmware UPGRADE
Affected: < 2.7.0
Fixed in: 2.7.0
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
siemens 6bk1602-0aa52-0tp0 firmware UPGRADE
Affected: < 2.7.0
Fixed in: 2.7.0
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
apache log4j UPGRADE
Affected: >= 2.0.1 and < 2.3.1 · >= 2.4.0 and < 2.12.2 · >= 2.13.0 and < 2.15.0 · 2.0 · 2.0 beta9 · 2.0 rc1 · 2.0 rc2
Fixed in: 2.3.1, 2.12.2, 2.15.0
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy log4j || rpm -q log4j || log4j --version
2. UPGRADE to 2.3.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade log4j
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade log4j
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison log4j sudo apt install log4j=<VERSION_BEFORE_2.0> sudo apt-mark hold log4j
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list log4j sudo dnf downgrade log4j-<VERSION_BEFORE_2.0> sudo dnf versionlock add log4j
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Maven · org.apache.logging.log4j:log4j-core · FIXED · 2.15.0 · vulnerable: >= 2.13.0, < 2.15.0 · source
Set org.apache.logging.log4j:log4j-core to 2.15.0 or later in pom.xml or build.gradle, then rebuild and redeploy.
Maven · com.guicedee.services:log4j-core · NO FIX YET · vulnerable: <= 1.2.1.2-jre17 · source
Maven · org.xbib.elasticsearch:log4j · NO FIX YET · vulnerable: = 6.3.2.1 · source
Maven · uk.co.nichesolutions.logging.log4j:log4j-core · NO FIX YET · vulnerable: = 2.6.3-CUSTOM · source
Fedora 46 · vipr · FIXED · 1.1^20261024.99eec19-1.fc46 · FEDORA-2026-2c5f53d2f8 · source
sudo dnf upgrade --advisory=FEDORA-2026-2c5f53d2f8
Fedora ELN · composer · FIXED · 2.11.1-1.eln159 · FEDORA-2026-cb4f992456 · source
sudo dnf upgrade --advisory=FEDORA-2026-cb4f992456
Ubuntu 20.04 · apache-log4j2 · FIXED · 2.15.0-0.20.04.1
sudo apt update && sudo apt install --only-upgrade apache-log4j2 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' apache-log4j2)" ge "2.15.0-0.20.04.1" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 22.04 · apache-log4j2 · NOT AFFECTED
Debian 12 · apache-log4j1.2 · NOT AFFECTED
Debian 13 · apache-log4j1.2 · NOT AFFECTED
Debian 12 · apache-log4j2 · FIXED · 2.15.0-1
sudo apt update && sudo apt install --only-upgrade apache-log4j2 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' apache-log4j2)" ge "2.15.0-1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · apache-log4j2 · FIXED · 2.15.0-1
sudo apt update && sudo apt install --only-upgrade apache-log4j2 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' apache-log4j2)" ge "2.15.0-1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 6 · log4j · NOT AFFECTED
RHEL 7 · log4j · NOT AFFECTED
RHEL 8 · parfait:0.5/log4j12 · NOT AFFECTED
Amazon Linux 2 · see advisory · FIXED · ALAS2-2021-1731 · source
sudo yum update --advisory=ALAS2-2021-1731
Amazon Linux 1 · see advisory · FIXED · ALAS-2021-1553 · source
sudo yum update --advisory=ALAS-2021-1553

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Advisories and coverage

Official advisories

Research and news

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-44228?

6bk1602-0aa12-0tp0 firmware: upgrade to 2.7.0; 6bk1602-0aa22-0tp0 firmware: upgrade to 2.7.0; 6bk1602-0aa32-0tp0 firmware: upgrade to 2.7.0. Exact commands for each OS are on this page.

Is CVE-2021-44228 being exploited?

Yes. CVE-2021-44228 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2021-44228 affect?

CVE-2021-44228 affects 6bk1602-0aa12-0tp0 firmware, 6bk1602-0aa22-0tp0 firmware, 6bk1602-0aa32-0tp0 firmware. Severity is critical (CVSS 10.0). Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoint

How urgent is CVE-2021-44228?

Priority 100/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Used in ransomware campaigns; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

Software pages

Apache Log4j vulnerabilities · Siemens vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.