In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applic

Summary

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Timeline

1. Apr 17, 2017, 9:00 PM UTCCVE published
2. Oct 8, 2026, 9:12 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 8, 2026, 9:14 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Log4j

  All versions between 2.0-alpha1 and 2.8.1

• org.apache.logging.log4j:log4jMaven

  From 2.0 · fixed in 2.8.2

• org.apache.logging.log4j:log4j-coreMaven

  From 2.0 · fixed in 2.8.2

References 25