The vulnerability arises because the verifyHostName attribute in the <Ssl> element of Apache Log4j Core was introduced in version 2.12.0 but ignored up to version 2.25.3, leaving TLS connections vulnerable to interception despite configuration. This incomplete fix follows an earlier CVE-2025-68161 that addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property. The flaw affects SMTP, Socket, and Syslog appenders using TLS with nested <Ssl> configuration. An attacker capable of presenting a certificate trusted by the appender's trust store can exploit this to perform man-in-the-middle attacks. The HTTP appender is unaffected as it uses a separate, correctly functioning verifyHostname attribute. The vendor recommends upgrading to Log4j Core 2.25.4 to resolve the issue.

This vulnerability allows a network-based attacker to potentially intercept and manipulate TLS connections established by affected Log4j Core appenders (SMTP, Socket, Syslog) if the attacker can present a trusted certificate. This undermines the confidentiality and integrity of data transmitted over these connections. The HTTP appender is not impacted. There are no known exploits in the wild at this time.

Users should upgrade to Apache Log4j Core version 2.25.4, which corrects the improper hostname verification issue. No other mitigations are specified or required as the fix is available. Patch status is confirmed by the vendor advisory recommending this upgrade.