Loading story…
Apache disclosed CVE-2021-45105, a Log4j context-lookup vulnerability that could trigger a stack overflow and denial of service under specific conditions, adding to the remediation burden during the Log4Shell crisis. In December 2021, Apache recommended Log4j 2.17.0 for users running Java 8 or later to address the flaw; Log4j 1.x was reported unaffected by this specific vulnerability. The disclosure followed active exploitation of CVE-2021-44228, the earlier Log4Shell vulnerability, with Conti reportedly targeting VMware applications for lateral movement and Khonsari identified among early ransomware actors exploiting it.
The breadth of Log4j dependencies complicated mitigation: Google reported that more than 35,000 Java packages were affected by Log4Shell. CISA urged US federal agencies to patch immediately and report vulnerable infrastructure or applications, and issued Emergency Directive 22-02 to mitigate the Apache Log4j vulnerability; its directive page is now marked closed. The overlapping flaws underscored the need to inventory embedded and transitive Log4j dependencies, coordinate updates with application vendors, and investigate potentially exposed systems for exploitation rather than treating patch installation alone as evidence that a compromise had not occurred.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
CVE-2021-45105 came to light following the earlier Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046. Under specific conditions, malicious input to context lookups can trigger a stack overflow and denial of service.
CISA advised US federal agencies to patch immediately and report information concerning vulnerable infrastructure or applications.
Google research found that more than 35,000 Java packages were impacted in some way by Log4j. The research highlighted difficulties in identifying dependencies between affected packages and applications.
Bleeping Computer reported that the Conti ransomware group was exploiting Log4Shell to attack VMware applications. The reported activity focused on internal networks and lateral movement during post-exploitation.
The Khonsari ransomware group was identified as being among the first actors to exploit CVE-2021-44228, also known as Log4Shell.
Apache Log4j 2.17.0 fixed CVE-2021-45105, and Apache recommended upgrading users running Java 8 or later. Apache also identified modifying context lookup functionality as a mitigation and stated that Log4j 1.x was unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Log4j remained at the center of a major software supply chain security crisis after **Log4Shell** (`CVE-2021-44228`) exposed Java applications to remote code execution through crafted requests that could force vulnerable systems to retrieve and run attacker-controlled payloads. The flaw affected Log4j `2.0-beta9` through `2.14.1`, was reported as easy to exploit, and was observed in widespread attacks across enterprise networks, prompting urgent calls to identify exposed assets and apply vendor fixes or mitigations. Remediation proved more complex as Apache issued updates and additional Log4j vulnerabilities emerged, including `CVE-2021-45046`, `CVE-2021-45105`, and `CVE-2021-44832`, raising concerns that patching alone would not address prior compromise or attacker persistence. Organizations were pushed to combine software updates with threat hunting and incident response, while defenders also relied on community tracking of affected products through resources such as CISA's `log4j-affected-db`, which has since been archived as read-only.
Aug 26, 2026
The Dutch National Cyber Security Centre (NCSC) issued a **HIGH/HIGH** warning for the Apache Log4j/Log4Shell flaws, led by remote-code-execution vulnerabilities including `CVE-2021-44228` and `CVE-2021-45046`. Applications that log attacker-controlled input can allow remote execution with web-server privileges, creating a material risk of major disruption and ransomware. Public exploit techniques, Log4j’s deep presence in third-party products, and incomplete asset visibility made vulnerable deployments difficult to identify; the NCSC reported limited active abuse but expected continued scanning and targeted attacks. Organizations were urged to inventory direct and supply-chain use of Log4j 2, promptly apply vendor patches, and isolate, mitigate, or disable unpatchable internet-facing systems that process untrusted input. The NCSC advised prioritizing versions affected by the earlier RCE flaws—`2.0-beta9` through `2.12.1` and `2.13.0` through `2.15.0`—and updating from `2.15` to `2.16` and subsequently to current Apache releases, including `2.17.0` where applicable for later issues such as `CVE-2021-45105`. It also called for log review and threat hunting from at least 1 December, forensic preservation, tested offline backups, segmentation, restricted outbound access, and use of its GitHub repository for affected-product tracking, indicators, detection rules, scanning, and mitigation guidance.
Sep 3, 2026
A critical remote code execution flaw in Apache Log4j, tracked as **`CVE-2021-44228`** and widely known as **Log4Shell**, exposed a vast range of Java applications and services to unauthenticated compromise through the library’s JNDI lookup feature. Security reporting said the bug affected Log4j versions **`2.0-beta9` through `2.14.1`**, with early warnings surfacing through attacks against Minecraft servers before researchers and vendors confirmed broader exposure across enterprise software, cloud services, and Apache frameworks including Struts2, Solr, Druid, Flink, and Kafka. Researchers also warned that exploitation could lead not only to remote code execution but also to leakage of sensitive environment data such as cloud credentials and developer secrets. Exploit code was released publicly and was quickly followed by heavy Internet-wide scanning and attack activity, including targeting of **VMware vCenter Server**, where VMware confirmed exploitation attempts in the wild and urged immediate mitigation. **CISA** described the flaw as one of the most serious vulnerabilities in recent memory and warned that **hundreds of millions of devices** could be affected, with likely follow-on abuse by cryptominers, ransomware operators, and other threat actors. Apache responded with a series of Log4j updates, including releases such as **`2.12.2`**, **`2.12.3`**, **`2.12.4`**, and **`2.3.1`**, while defenders published detection content and scanning tools as organizations raced to identify vulnerable systems and reduce exposure.
Aug 28, 2026