CVE-2026-40023

OVERVIEW CVE-2026-40023 affects Apache Log4cxx versions prior to 1.7.0 and involves improper sanitization of XML-forbidden characters in the XMLLayout component. When processing log messages, NDC (Nested Diagnostic Context), and MDC (Mapped Diagnostic Context) properties, the vulnerability fails to remove characters that violate XML 1.0 specification standards. This results in malformed XML output that conforming parsers will reject, potentially causing downstream log processing systems to drop or fail to index affected records. SEVERITY The vulnerability carries a CVSS score of 5.3 (MEDIUM) with a network-based attack vector requiring no special privileges or user interaction. The attack complexity is low, making exploitation straightforward for an attacker who can influence logged data. While the vulnerability does not directly compromise confidentiality or enable remote code execution, it has integrity implications by allowing attackers to suppress individual log records. This impairs audit trails and can hinder detection of malicious activity within logging systems. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.0025 indicates minimal real-world exploitation probability. Community attention appears limited, reflected in its moderate FAUCET Risk Score of 32.0/100. Organizations should prioritize upgrading to Log4cxx 1.7.0 to prevent potential abuse, though the immediate threat level remains low.