CVE Watch—

CVE-2021-45046

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

CVSS

—

No CVSS

EPSS

100.0%

p100

KEV

YES

May 1, 2023

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

100.0%EPSS · 30 days100.0%

2026-06-302026-07-16

KEV catalog record

Product

Apache / Log4j2

Vulnerability

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

Added to KEV

May 1, 2023

Remediate by

May 22, 2023

Known ransomware use

Yes

Summary description

Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.

Required action

Apply updates per vendor instructions.

Notes

https://logging.apache.org/log4j/2.x/security.html; https://nvd.nist.gov/vuln/detail/CVE-2021-45046

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2021-44228—

100.0%

KEV—80Apache Log4j2 Remote Code Execution Vulnerability—