CVE-2021-44228

Actively exploited

CISA lists CVE-2021-44228 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Apache Log4j2.

• For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Public exploit: Cataloged public exploit.

• Rapid7 Metasploit: MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell) (2026-09-23 21:40:29.350562+00)

  Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.

• Rapid7 Metasploit: Log4Shell HTTP Header Injection (2026-09-23 21:40:29.350562+00)

  Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.

• Rapid7 Metasploit: UniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell) (2026-09-23 21:40:29.350562+00)

  Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.

• Rapid7 Metasploit: VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell) (2026-09-23 21:40:29.350562+00)

  Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.

• Exploit-DB: Apache Log4j2 2.14.1 - Information Disclosure (2026-09-23 21:40:27.335989+00)

  Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.

• Exploit-DB: Apache Log4j 2 - Remote Code Execution (RCE) (2026-09-23 21:40:27.335989+00)

  Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.

• Exploit-DB: AD Manager Plus 7122 - Remote Code Execution (RCE) (2026-09-23 21:40:27.335989+00)

  Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.