CRITICALCVSS v3.1 9.0Actively exploited · CISA KEV since 2023-05-01Vulnerability

CVE-2021-45046

Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.

Properties

Euvd product
Apache Log4j
Vulnerability name
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
First seen
2025-10-21T23:25:22+00:00
Cvss score
9
Epss score
0.99977
Last seen
2026-10-19T12:00:27+00:00
Due date
2023-05-22
Euvd assigner
apache
Retrieved at
2026-10-21T01:24:47+00:00
Exploited euvd since
2023-05-01T00:00:00+00:00
Src batch id
epss_history-20261020T103617Z-728ddd
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Date added
2023-05-01
Score
9
Euvd base score version
3.1
Fetched at
2026-10-20T10:36:20+00:00
Euvd vendor
Apache Software Foundation
Cvss vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
In Signal since
initial import (Sep 2026)
Euvd base score
9

Related Entities (98 · showing 23)

AFFECTS_PRODUCT (95 · showing 20)

→[Product]cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:siemens:6bk1602-0aa32-0tp0:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:*
→[Product]cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:siemens:6bk1602-0aa12-0tp0:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:siemens:6bk1602-0aa52-0tp0:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:tracealertserverplus:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:*
→[Product]cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:*

DESCRIBES (1)

←[KEVEntry]Apache Log4j2 Deserialization of Untrusted Data Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

INVOLVES (1)

←[Signal]kev_added · 2023-05-01

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2021-45046 (CVSS v3.1 9) — Ninja Signal Threat Intelligence | Ninja Signal