---
id: "CVE-2021-45046"
kind: "vulnerability"
aliases: ["CVE-2021-45046"]
title: "It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default\u2026"
severity: "critical"
cvss: 9.0
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Apache Log4j2", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apache log4j", "fixed": ["2.12.2"], "affected": ">= 2.0.1, < 2.12.2", "ecosystem": "vendor"}, {"name": "apache log4j", "fixed": ["2.16.0"], "affected": ">= 2.13.0, < 2.16.0", "ecosystem": "vendor"}, {"name": "apache log4j", "fixed": [], "affected": "= 2.0", "ecosystem": "vendor"}, {"name": "cvat computer vision annotation tool", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "intel audio development kit", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "intel datacenter manager", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "intel genomics kernel library", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "intel oneapi", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "intel secure device onboard", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "intel sensor solution firmware development kit", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "intel system debugger", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "intel system studio", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "siemens sppa-t3000 ses3000 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "siemens captial", "fixed": ["2019.1"], "affected": "< 2019.1", "ecosystem": "vendor"}, {"name": "siemens captial", "fixed": [], "affected": "= 2019.1", "ecosystem": "vendor"}, {"name": "siemens comos", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "siemens desigo cc advanced reports", "fixed": [], "affected": "= 4.0", "ecosystem": "vendor"}, {"name": "siemens desigo cc advanced reports", "fixed": [], "affected": "= 4.1", "ecosystem": "vendor"}, {"name": "siemens desigo cc advanced reports", "fixed": [], "affected": "= 4.2", "ecosystem": "vendor"}, {"name": "siemens desigo cc advanced reports", "fixed": [], "affected": "= 5.0", "ecosystem": "vendor"}, {"name": "siemens desigo cc advanced reports", "fixed": [], "affected": "= 5.1", "ecosystem": "vendor"}, {"name": "siemens desigo cc info center", "fixed": [], "affected": "= 5.0", "ecosystem": "vendor"}, {"name": "siemens desigo cc info center", "fixed": [], "affected": "= 5.1", "ecosystem": "vendor"}, {"name": "siemens e-car operation center", "fixed": ["2021-12-13"], "affected": "< 2021-12-13", "ecosystem": "vendor"}, {"name": "siemens energy engage", "fixed": [], "affected": "= 3.1", "ecosystem": "vendor"}, {"name": "siemens energyip", "fixed": [], "affected": "= 8.5", "ecosystem": "vendor"}, {"name": "siemens energyip", "fixed": [], "affected": "= 8.6", "ecosystem": "vendor"}, {"name": "siemens energyip", "fixed": [], "affected": "= 8.7", "ecosystem": "vendor"}, {"name": "siemens energyip", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "siemens energyip prepay", "fixed": [], "affected": "= 3.7", "ecosystem": "vendor"}, {"name": "siemens energyip prepay", "fixed": [], "affected": "= 3.8", "ecosystem": "vendor"}, {"name": "siemens gma-manager", "fixed": ["8.6.2j-398"], "affected": "< 8.6.2j-398", "ecosystem": "vendor"}, {"name": "siemens head-end system universal device integration system", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "siemens industrial edge management", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "siemens industrial edge management hub", "fixed": ["2021-12-13"], "affected": "< 2021-12-13", "ecosystem": "vendor"}, {"name": "siemens logo\\! soft comfort", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "siemens mendix", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "siemens mindsphere", "fixed": ["2021-12-11"], "affected": "< 2021-12-11", "ecosystem": "vendor"}, {"name": "siemens navigator", "fixed": ["2021-12-13"], "affected": "< 2021-12-13", "ecosystem": "vendor"}, {"name": "siemens nx", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "log4j2", "package", "ransomware", "self-hosted"]
not_affected_if: ["default-config", "non-java-stack"]
published_at: "2021-12-14T19:15:07+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-45046", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default…

Apache Log4j2, a Java logging library, has a flaw where the Thread Context Lookup Pattern can be used to run code via crafted log input. An attacker who can get attacker-controlled text into a log message can execute code on the server in certain non-default configurations.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Log4j2 affected ? fixed ?
- vendor:apache log4j affected >= 2.0.1, < 2.12.2 fixed 2.12.2
- vendor:apache log4j affected >= 2.13.0, < 2.16.0 fixed 2.16.0
- vendor:apache log4j affected = 2.0 fixed ?
- vendor:cvat computer vision annotation tool affected ? fixed ?
- vendor:intel audio development kit affected ? fixed ?
- vendor:intel datacenter manager affected ? fixed ?
- vendor:intel genomics kernel library affected ? fixed ?
- vendor:intel oneapi affected ? fixed ?
- vendor:intel secure device onboard affected ? fixed ?
- vendor:intel sensor solution firmware development kit affected ? fixed ?
- vendor:intel system debugger affected ? fixed ?
- vendor:intel system studio affected ? fixed ?
- vendor:siemens sppa-t3000 ses3000 firmware affected ? fixed ?
- vendor:siemens captial affected < 2019.1 fixed 2019.1
- vendor:siemens captial affected = 2019.1 fixed ?
- vendor:siemens comos affected ? fixed ?
- vendor:siemens desigo cc advanced reports affected = 4.0 fixed ?
- vendor:siemens desigo cc advanced reports affected = 4.1 fixed ?
- vendor:siemens desigo cc advanced reports affected = 4.2 fixed ?
- vendor:siemens desigo cc advanced reports affected = 5.0 fixed ?
- vendor:siemens desigo cc advanced reports affected = 5.1 fixed ?
- vendor:siemens desigo cc info center affected = 5.0 fixed ?
- vendor:siemens desigo cc info center affected = 5.1 fixed ?
- vendor:siemens e-car operation center affected < 2021-12-13 fixed 2021-12-13
- vendor:siemens energy engage affected = 3.1 fixed ?
- vendor:siemens energyip affected = 8.5 fixed ?
- vendor:siemens energyip affected = 8.6 fixed ?
- vendor:siemens energyip affected = 8.7 fixed ?
- vendor:siemens energyip affected = 9.0 fixed ?
- vendor:siemens energyip prepay affected = 3.7 fixed ?
- vendor:siemens energyip prepay affected = 3.8 fixed ?
- vendor:siemens gma-manager affected < 8.6.2j-398 fixed 8.6.2j-398
- vendor:siemens head-end system universal device integration system affected ? fixed ?
- vendor:siemens industrial edge management affected ? fixed ?
- vendor:siemens industrial edge management hub affected < 2021-12-13 fixed 2021-12-13
- vendor:siemens logo\! soft comfort affected ? fixed ?
- vendor:siemens mendix affected ? fixed ?
- vendor:siemens mindsphere affected < 2021-12-11 fixed 2021-12-11
- vendor:siemens navigator affected < 2021-12-13 fixed 2021-12-13
- vendor:siemens nx affected ? fixed ?

## Fix

Upgrade Apache Log4j2 to a fixed release (the sources do not name the version; check the Apache Log4j security page). Remove the JndiLookup class from log4j-core jars if upgrading is not possible.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-45046
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-45046

## From the sources

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_