CVE-2021-4104 [High] | RCE in Log4j

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-04-22	69.28%	72.20%	+2.92%
2	2026-03-11	72.20%	69.28%	-2.92%
3	2026-03-04	—	72.20%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-04-22

69.28%

72.20%

+2.92%

2026-03-11

72.20%

69.28%

-2.92%

2026-03-04

—

72.20%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.5	3.1	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.6	5.9	[email protected]
7.5	3.1	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.6	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0
6.0	2.0	MEDIUM	`AV:N/AC:M/Au:S/C:P/I:P/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:S) A single authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	6.8	6.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.5

3.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.6

5.9

[email protected]

7.5

3.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.6

5.9

134c704f-9b21-4f2e-91b3-4a467353bcc0

6.0

2.0

MEDIUM

AV:N/AC:M/Au:S/C:P/I:P/A:P Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:S): A single authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

6.8

6.4

[email protected]

OS Trackers for CVE-2021-4104

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2021-4104 not yet assigned priority: Debian including 1 source packages (apache-log4j1.2), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2021-4104
`gentoo`	normal	CVE-2021-4104: 4 GLSA(s) (202209-02, 202310-16, 202312-02, 202312-04), 4 atom(s) (app-backup/tsm, dev-embedded/arduino, games-server/minecraft-server, net-wireless/unifi); latest impact normal.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2021-4104
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2021-4104
`suse`	medium	CVE-2021-4104 severity moderate: SUSE including 362 source package names (amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, amazon/suse-sles-15-sp1-chost-byos-v20220127-hvm-ssd-x86_64, …), 538 product×package rows across 69 product lines (HPE Helion OpenStack 8, SUSE CaaS Platform 4.0, … (69 product lines)): Fixed 259, Known Affected 231, Known Not Affected 48.	https://www.suse.com/security/cve/CVE-2021-4104/
`ubuntu`	medium	CVE-2021-4104 medium priority: Ubuntu including 1 source packages (apache-log4j1.2), 14 status rows across 14 suites (bionic, focal, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, trusty, upstream, xenial): released 7, not-affected 5, ignored 2.	https://ubuntu.com/security/CVE-2021-4104

Affected software / configurations for CVE-2021-4104

Vendor	Product	Version	Raw CPE
apache	log4j	1.2	cpe:2.3:a:apache:log4j:1.2:::::::*
fedoraproject	fedora	35	cpe:2.3:o:fedoraproject:fedora:35:::::::*
redhat	codeready_studio	12.0	cpe:2.3:a:redhat:codeready_studio:12.0:::::::*
redhat	integration_camel_k	—	cpe:2.3:a:redhat:integration_camel_k:-:::::::*
redhat	integration_camel_quarkus	—	cpe:2.3:a:redhat:integration_camel_quarkus:-:::::::*
redhat	jboss_a-mq	6.0.0	cpe:2.3:a:redhat:jboss_a-mq:6.0.0:::::::*
redhat	jboss_a-mq	7	cpe:2.3:a:redhat:jboss_a-mq:7:::::::*
redhat	jboss_a-mq_streaming	—	cpe:2.3:a:redhat:jboss_a-mq_streaming:-:::::::*
redhat	jboss_data_grid	7.0.0	cpe:2.3:a:redhat:jboss_data_grid:7.0.0:::::::*
redhat	jboss_data_virtualization	6.0.0	cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:::::::*
redhat	jboss_enterprise_application_platform	6.0.0	cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:::::::*
redhat	jboss_enterprise_application_platform	7.0	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:::::::*
redhat	jboss_fuse	6.0.0	cpe:2.3:a:redhat:jboss_fuse:6.0.0:::::::*
redhat	jboss_fuse	7.0.0	cpe:2.3:a:redhat:jboss_fuse:7.0.0:::::::*
redhat	jboss_fuse_service_works	6.0	cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:::::::*
redhat	jboss_operations_network	3.0	cpe:2.3:a:redhat:jboss_operations_network:3.0:::::::*
redhat	jboss_web_server	3.0	cpe:2.3:a:redhat:jboss_web_server:3.0:::::::*
redhat	openshift_application_runtimes	—	cpe:2.3:a:redhat:openshift_application_runtimes:-:::::::*
redhat	openshift_container_platform	4.6	cpe:2.3:a:redhat:openshift_container_platform:4.6:::::::*
redhat	openshift_container_platform	4.7	cpe:2.3:a:redhat:openshift_container_platform:4.7:::::::*
redhat	openshift_container_platform	4.8	cpe:2.3:a:redhat:openshift_container_platform:4.8:::::::*
redhat	process_automation	7.0	cpe:2.3:a:redhat:process_automation:7.0:::::::*
redhat	single_sign-on	7.0	cpe:2.3:a:redhat:single_sign-on:7.0:::::::*
redhat	software_collections	—	cpe:2.3:a:redhat:software_collections:-:::::::*
redhat	enterprise_linux	6.0	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
redhat	enterprise_linux	7.0	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
oracle	advanced_supply_chain_planning	12.1	cpe:2.3:a:oracle:advanced_supply_chain_planning:12.1:::::::*
oracle	advanced_supply_chain_planning	12.2	cpe:2.3:a:oracle:advanced_supply_chain_planning:12.2:::::::*
oracle	business_intelligence	5.9.0.0.0	cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0::::enterprise:::
oracle	business_intelligence	12.2.1.3.0	cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0::::enterprise:::
oracle	business_intelligence	12.2.1.4.0	cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0::::enterprise:::
oracle	business_process_management_suite	12.2.1.3.0	cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:::::::*
oracle	business_process_management_suite	12.2.1.4.0	cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:::::::*
oracle	communications_eagle_ftp_table_base_retrieval	4.5	cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:::::::*
oracle	communications_messaging_server	8.1	cpe:2.3:a:oracle:communications_messaging_server:8.1:::::::*
oracle	communications_network_integrity	7.3.6	cpe:2.3:a:oracle:communications_network_integrity:7.3.6:::::::*
oracle	communications_offline_mediation_controller	< 12.0.0.4.0	cpe:2.3:a:oracle:communications_offline_mediation_controller::::::::
oracle	communications_offline_mediation_controller	12.0.0.5.0	cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:::::::*
oracle	communications_unified_inventory_management	7.3.4	cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:::::::*
oracle	communications_unified_inventory_management	7.3.5	cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:::::::*
oracle	communications_unified_inventory_management	7.4.1	cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:::::::*
oracle	communications_unified_inventory_management	7.4.2	cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:::::::*
oracle	e-business_suite_cloud_manager_and_cloud_backup_module	2.2.1.1.1	cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:2.2.1.1.1:::::::*
oracle	enterprise_manager_base_platform	13.4.0.0	cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:::::::*
oracle	enterprise_manager_base_platform	13.5.0.0	cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:::::::*
oracle	financial_services_revenue_management_and_billing_analytics	2.7.0.0	cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.0:::::::*
oracle	financial_services_revenue_management_and_billing_analytics	2.7.0.1	cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.1:::::::*
oracle	financial_services_revenue_management_and_billing_analytics	2.8.0.0	cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8.0.0:::::::*
oracle	fusion_middleware_common_libraries_and_tools	12.2.1.4.0	cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:12.2.1.4.0:::::::*
oracle	goldengate	—	cpe:2.3:a:oracle:goldengate:-:::::::*
oracle	healthcare_data_repository	8.1.0	cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:::::::*
oracle	hyperion_data_relationship_management	< 11.2.8.0	cpe:2.3:a:oracle:hyperion_data_relationship_management::::::::
oracle	hyperion_infrastructure_technology	< 11.2.8.0	cpe:2.3:a:oracle:hyperion_infrastructure_technology::::::::
oracle	identity_management_suite	12.2.1.3.0	cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:::::::*
oracle	identity_management_suite	12.2.1.4.0	cpe:2.3:a:oracle:identity_management_suite:12.2.1.4.0:::::::*
oracle	jdeveloper	12.2.1.3.0	cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:::::::*
oracle	mysql_enterprise_monitor	<= 8.0.29	cpe:2.3:a:oracle:mysql_enterprise_monitor::::::::
oracle	retail_allocation	14.1.3.2	cpe:2.3:a:oracle:retail_allocation:14.1.3.2:::::::*
oracle	retail_allocation	15.0.3.1	cpe:2.3:a:oracle:retail_allocation:15.0.3.1:::::::*
oracle	retail_allocation	16.0.3	cpe:2.3:a:oracle:retail_allocation:16.0.3:::::::*
oracle	retail_allocation	19.0.1	cpe:2.3:a:oracle:retail_allocation:19.0.1:::::::*
oracle	retail_extract_transform_and_load	13.2.5	cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.5:::::::*
oracle	stream_analytics	—	cpe:2.3:a:oracle:stream_analytics:-:::::::*
oracle	timesten_grid	—	cpe:2.3:a:oracle:timesten_grid:-:::::::*
oracle	tuxedo	12.2.2.0.0	cpe:2.3:a:oracle:tuxedo:12.2.2.0.0:::::::*
oracle	utilities_testing_accelerator	6.0.0.1.1	cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:::::::*
oracle	utilities_testing_accelerator	6.0.0.2.2	cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:::::::*
oracle	utilities_testing_accelerator	6.0.0.3.1	cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:::::::*
oracle	weblogic_server	12.2.1.3.0	cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:::::::*
oracle	weblogic_server	12.2.1.4.0	cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:::::::*
oracle	weblogic_server	14.1.1.0.0	cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:::::::*

References for CVE-2021-4104

URL	Tags
http://www.openwall.com/lists/oss-security/2022/01/18/3
https://access.redhat.com/security/cve/CVE-2021-4104
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033
https://security.gentoo.org/glsa/202209-02
https://security.gentoo.org/glsa/202310-16
https://security.gentoo.org/glsa/202312-02
https://security.gentoo.org/glsa/202312-04
https://security.netapp.com/advisory/ntap-20211223-0007/
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.kb.cert.org/vuls/id/930724
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpujul2022.html

URL

CVE-2021-4104 | Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

Exploit prediction scoring system (EPSS) score for CVE-2021-4104

Common vulnerability scoring system (CVSS) metrics for CVE-2021-4104

Weakness enumeration for CVE-2021-4104

GitHub Security Advisory for CVE-2021-4104

OS Trackers for CVE-2021-4104

Affected software / configurations for CVE-2021-4104

References for CVE-2021-4104