CVE-2021-45046VulnerabilityPublished 05/01/2023Updated 10/24/2026
CVE-2021-45046: Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Affects Apache Log4j2Source CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 05/01/2023
- KEV deadline
- 05/22/2023
- Ransomware
- Used in ransomware campaigns
- EPSS
- 100.0% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.