CVE-2026-40021

OVERVIEW CVE-2026-40021 affects Apache Log4net versions prior to 3.3.0, specifically impacting the XmlLayout and XmlLayoutSchemaLog4J components. The vulnerability stems from failure to sanitize XML 1.0-forbidden characters in MDC (Mapped Diagnostic Context) property keys and values, as well as the identity field. When these fields contain attacker-influenced data with invalid XML characters, serialization exceptions occur, causing affected log events to be silently dropped from audit trails. SEVERITY This vulnerability carries a CVSS score of 5.3 (Medium) with a network-based attack vector requiring no authentication or user interaction. The primary impact is integrity-based, as attackers can selectively suppress log records to conceal malicious activity or compromise audit trail completeness. While the attack complexity is low and the vulnerability is easily exploitable, the scope remains unchanged with no confidentiality or availability impacts from the vulnerability itself. The EPSS score of 0.0025 indicates this is not currently a widespread threat. EXPLOITATION STATUS There is no evidence of active exploitation, as this vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. No public exploit code availability has been reported. Community attention remains minimal given the low EPSS score and specialized nature of the attack. Organizations should prioritize patching based on their use of Log4net's XML layout configurations and exposure to untrusted input sources.