Critical Log4j2 Deserialization Flaw (CVE‑2021‑45046) Enables Remote Code Execution
What It Is — Apache Log4j2 contains a deserialization of untrusted data flaw that can lead to remote code execution when the Thread Context Lookup pattern is enabled in non‑default configurations. The issue is an incomplete remediation of the earlier Log4Shell (CVE‑2021‑44228) bug.
Exploitability — Public proof‑of‑concept code exists; attackers can trigger RCE without authentication. CVSS v3.1 base score 9.8 (Critical).
Affected Products — Apache Log4j2 library 2.0‑2.15.0 (any product embedding these versions).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of third‑party components is essential to prove due‑diligence and maintain a defensible audit trail.
- Timely patching of open‑source libraries satisfies the control objective of “vulnerability remediation” across the software supply chain, a signal that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001).
- Demonstrable evidence of remediation can be presented in a Trust Center to reassure enterprise buyers that the organization’s control environment is robust.
Recommended Actions
- Inventory all assets that include Log4j2 and verify the exact version in use.
- Upgrade to Log4j 2.16.0 or later, or apply the official mitigation guidance if upgrade is not immediately possible.
- Record the remediation steps in your change‑management system and feed the version data into a continuous‑monitoring solution for ongoing assurance.
Source: CISA KEV – CVE‑2021‑45046