CVE-2021-44228

Log4j2 is a piece of software used by many applications to record events in logs. This flaw can trick Log4j2 into trying to “look up” attacker-controlled network addresses when it processes certain log messages, which can then lead to running malicious code on the server.

Think of it like someone writing a dangerous instruction inside a note that your computer later “reads” and follows while trying to save it as a log entry—if the system is set up a certain way, that instruction can take over the machine.

This matters if you run software that includes Apache Log4j2 (log4j-core) or any listed products whose underlying components include vulnerable Log4j2 versions.

It’s a real risk even without any user clicking anything, and without needing login, if the server can be reached from the network and it processes attacker-controlled content that reaches Log4j2 message logging while the relevant message lookup/JNDI behavior is enabled (reachable in default configuration).

This is RED because it has been added to CISA KEV and is known to be used in ransomware campaigns. Attackers do not need you to click anything or log in—they can trigger the behavior by getting malicious text into log messages.

Treat this as an urgent, time-bound patch/remediation project for any affected Log4j2-using systems and any affected firmware/products with available updates.