Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exe

Summary

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Timeline

1. Dec 20, 2019, 4:01 PM UTCCVE published
2. May 28, 2026, 6:29 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. May 28, 2026, 6:30 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Log4j

  versions up to 1.2.17

• log4j:log4jMaven

  From 1.2 · through 1.2.17

• org.zenframework.z8.dependencies.commons:log4j-1.2.17Maven

  2.0

References 28