Called exploited 4 days before disclosure.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing4d
- Last KEV listing4d
- Last sighting4.7y
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Dec 10, 2021
- EUVDENISA, European Unionlisted Dec 10, 2021
- VulnCheck KEVcommercial researchlisted Dec 6, 2021
- CIRCLaggregator, mirrors the abovelisted Dec 10, 2021, not counted
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2021-4
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2021-4
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationhunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-a
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2021-4
1298 public reports collected from VulnCheck and CIRCL, first on Dec 6, 2021. Each links to its original source. We have not verified them.
Description
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Required action (CISA)
For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
