High 7.5HealthcarePublished Dec 13, 2021

CVE-2021-4104Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

Updated under an hour ago (Oct 27, 2026, 8:20 PM ET)

Does this affect you?

It affects Apache Software Foundation Apache Log4j 1.x and 46 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 80.60%, higher than 100% of scored CVEs. That is high: schedule it on your emergency patch path.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache Log4j 1.x

Exploited in the last 30 days

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

CVSS: 7.5 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-502
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 80.60% (percentile 100)
Assigned by: apache
NVD analysis: Modified
Record last updated: May 28, 2026
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

Apache Software Foundation Apache Log4j 1.x apache_software_foundation:apache_log4j_1.x (from the name)	Apache Log4j 1.2 1.2.x	CNA record
apache log4j apache:log4j	1.2	NVD
fedoraproject fedora fedoraproject:fedora	35	NVD
redhat codeready_studio redhat:codeready_studio	12.0	NVD
redhat integration_camel_k redhat:integration_camel_k	all versions	NVD
redhat integration_camel_quarkus redhat:integration_camel_quarkus	all versions	NVD
redhat jboss_a-mq redhat:jboss_a-mq	6.0.0; 7	NVD
redhat jboss_a-mq_streaming redhat:jboss_a-mq_streaming	all versions	NVD
redhat jboss_data_grid redhat:jboss_data_grid	7.0.0	NVD
redhat jboss_data_virtualization redhat:jboss_data_virtualization	6.0.0	NVD
1–10 of 47

References

References

https://www.cve.org/CVERecord?id=CVE-2021-44228
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://access.redhat.com/security/cve/CVE-2021-4104
https://www.kb.cert.org/vuls/id/930724	third-party-advisory
http://www.openwall.com/lists/oss-security/2022/01/18/3	mailing-list
https://www.oracle.com/security-alerts/cpujan2022.html
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033
https://security.netapp.com/advisory/ntap-20211223-0007/
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
1–10 of 14

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.