Log4j

Vendor:

First CVE: Apr 17, 2017 · Active for 9 years

20
Total CVEs
More Total CVEs than 94% of tracked products
2.5
Avg CVEs / Year
Higher CVE frequency than 74% of tracked products
7.7
Avg CVSS
Higher Avg CVSS than 62% of tracked products
10.0%
KEV Rate
Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Log4j over time

Volume of CVEsAvg CVSS Base Score
First CVE
Apr 17, 2017
9 years ago
Most Recent CVE
Jul 10, 2026
14 days ago

CVE Severity & Scoring

Log4j20 CVEs
All CVEs352,231 CVEs
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network20 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (60.0%)
High8 (40.0%)
Unknown0 (0.0%)
User Interaction
None20 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low3 (15.0%)
High1 (5.0%)
None16 (80.0%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (20 CVEs).

20 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2021-44228CRITICAL
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect agai
Dec 10, 202110.099YESYES
CVE-2021-45046CRITICAL
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Threa
Dec 14, 20219.098YESYES
CVE-2017-5645CRITICAL
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payloa
Apr 17, 20179.886NOYES
CVE-2021-44832MEDIUM
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses
Dec 28, 20216.676NONO
CVE-2021-45105MEDIUM
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker wit
Dec 18, 20215.976NONO
CVE-2019-17571CRITICAL
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a
Dec 20, 20199.872NONO
CVE-2021-4104HIGH
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName
Dec 14, 20217.570NONO
CVE-2022-23305CRITICAL
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message conv
Jan 18, 20229.868NONO
CVE-2022-23302HIGH
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration refere
Jan 18, 20228.863NONO
CVE-2022-23307HIGH
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exi
Jan 18, 20228.857NONO
View all 20 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (20 CVEs).

CISA KEV
2 CVEs
10.0% of CVEs· 97th percentile
Metasploit
2 CVEs
10.0% of CVEs· 97th percentile
Nuclei
3 CVEs
15.0% of CVEs· 98th percentile
ExploitDB
1 CVE
5.0% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (20 CVEs).

Media Mentions

Signals from CVEs in this product scope (20 CVEs).

Top CNAs Publishing CVEs For Log4j

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
3.0.066.90.6%00
2.26.015.90.7%00
2.047.373.2%22
1.217.581.2%00