INCIDENT REPORT · CP-2021-006
Log4Shell (Apache Log4j) vulnerability exploitation
L3 · ELEVATEDCONFIRMED
A critical remote code execution flaw in the widely used Apache Log4j Java logging library was disclosed on 9 December 2021. CISA reported active, widespread exploitation.
- Incident ID
- CP-2021-006
- Disclosure date
- 09 DEC 2021
- Detection date
- Not publicly documented
- Affected countries
- United States
- Plotted location
- Wilmington, United States (Maintainer of the affected software (Apache Software Foundation); affected systems were worldwide)
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Extremely widespread exposure across sectors, but the CSRB found no significant Log4j-based attacks on critical infrastructure.
- Attack type
- Vulnerability Exploitation
- Nature
- Malicious activity
- Attack vector
- Unauthenticated remote code execution in Apache Log4j 2 (CVE-2021-44228), affecting versions 2.0-beta9 through 2.14.1
- Sectors
- Technology, Government
- Critical infrastructure
- No
- Organizations affected
- Organizations using vulnerable Apache Log4j 2 versions worldwide
- Operational consequences
- CISA issued Emergency Directive 22-02 and added the flaw to its Known Exploited Vulnerabilities catalog. The Cyber Safety Review Board later called Log4j an 'endemic vulnerability' but found exploitation lower than many experts predicted.
- Estimated financial impact
- No reliably documented figure
- Attribution (as stated)
- No official attribution recorded
SOURCE REFERENCES
- [1] Statement from CISA Director Easterly on 'Log4j' VulnerabilityCISA · cisa.gov · 11 DEC 2021
- [2] First Cyber Safety Review Board report finds Log4j has become an 'endemic vulnerability'The Record · therecord.media · 14 JUL 2022
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.