CVE-2021-45046
CVE-2021-45046 is a security flaw in Apache Log4j2, open-source software from the Apache Software Foundation. Attackers can run their own code on Apache Log4j2. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of flaws known to be used in attacks on 1 May 2023, and says ransomware gangs have used it.[1]
Apache Log4j2 is business software or equipment. Most families won’t have it, but attackers break into it to get inside companies, and from there to what those companies hold about their customers, patients and staff. Fixed in version 2.16.0 of Apache Log4j.
Description
CISA calls it a deserialization of untrusted data in Apache Log4j2. In its words: “Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.”[1]
The CVE record adds: “It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.”[2]
The underlying weakness is CWE-917, in MITRE’s list of common software weaknesses.
It scores 9.0 out of 10 on the Common Vulnerability Scoring System, which rates it critical, scored by NVD using CVSS 3.1.[2]
Affected versions
NVD’s record lists one fixed version: everything before it is affected.[2]
| Product | Fixed in |
|---|---|
| Apache Log4j | 2.16.0 |
Most families won’t have Apache Log4j2; it’s for whoever looks after IT at work.
Exploitation
CISA added it to its catalog of known exploited vulnerabilities on 1 May 2023, 503 days after it was made public. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 22 May 2023 to fix it.[1] CISA says ransomware gangs have used it.
FIRST’s Exploit Prediction Scoring System, which estimates how likely a flaw is to be used in attacks in the next 30 days from what it sees across the internet, puts it at over 99%. That’s in the top 1% of the flaws it scores.[4]
CISA assesses it as not automatable: each attack takes some work.
CISA doesn’t say who was attacked, or how.
Fix
Apache has published a fix or advice.[3] CISA’s required action: “Apply updates per vendor instructions.”[1]
- Check whether you use it.Apache Log4j2 is business software or equipment, so most families won’t have it. If you run a business, or work from home on company equipment, ask whoever looks after your IT.
- Send this page to your IT person.Ask them to confirm it’s fixed (fixed in version 2.16.0 of Apache Log4j), or not in use. CISA gave US government agencies until 22 May 2023 to fix it.
- If it can’t be fixed, take it offline.CISA’s advice when there’s no fix is to stop using the product, or take it off the internet, until there is one.
You can’t fix someone else’s server, but you can watch for what follows a break-in like this: a breach notice, a password reset you didn’t ask for, or a scam message that knows things it shouldn’t. HARD watches for those for you and your family.
Timeline
| Date | Event |
|---|---|
| The flaw is made public in the National Vulnerability Database, with a severity score of 9.0.[2] | |
| CISA adds it to its catalog of flaws known to be used in attacks, noting that ransomware gangs have used it.[1] | |
| CISA’s deadline for US government agencies to fix it.[1] | |
| FIRST puts the odds of it being used in attacks in the next 30 days at over 99%.[4] |
See also
Other Apache Log4j2 flaws
- CVE-2021-44228: remote code execution ·
Other Apache flaws
- CVE-2016-3081, Apache Struts: command injection ·
- CVE-2026-34486, Apache Tomcat: missing encryption of sensitive data ·
- CVE-2026-34197, Apache ActiveMQ: improper input validation ·
- CVE-2024-38475, Apache HTTP Server: improper escaping of output ·
- CVE-2025-24813, Apache Tomcat: path equivalence ·
Similar flaws
- CVE-2022-26134, Atlassian Confluence Server/Data Center: confluence server and data center remote code execution ·
- CVE-2021-26084, Atlassian Confluence Server and Data Center: object-graph navigation language (OGNL) injection ·
- CVE-2020-10199, Sonatype Nexus Repository: remote code execution ·
Added the same day
- CVE-2023-21839, Oracle WebLogic Server: unspecified ·
- CVE-2023-1389, TP-Link Archer AX21: archer AX-21 command injection ·
Every Apache flaw on CISA’s list · Everything added in May 2023
References
- ^ Cybersecurity and Infrastructure Security Agency. “Apache Log4j2 Deserialization of Untrusted Data Vulnerability”. Known Exploited Vulnerabilities Catalog, added 1 May 2023.
- ^ National Institute of Standards and Technology. “CVE-2021-45046 Detail”. National Vulnerability Database, published 14 Dec 2021.
- ^ Apache. Advisories and fixes: logging.apache.org, lists.fedoraproject.org, lists.fedoraproject.org, oracle.com.
- ^ FIRST. “Exploit Prediction Scoring System”. EPSS 1.000, percentile 100.0, 31 Oct 2026.
- CVE Program. “CVE-2021-45046”. The official CVE record.
This article is built from CISA’s catalog (version 2026.10.30), NVD’s record and FIRST’s scores, kept in HARD’s database and checked every morning. The plain English is HARD’s.