Log4Shell: remote code execution through JNDI lookups in Apache Log4j (2021)
CVE-2021-44228 (Log4Shell) affects Apache Log4j 2.0-beta9 through 2.14.1 and lets an unauthenticated remote actor execute arbitrary code through JNDI lookups.
What happened
- CISA's guidance is to apply available patches immediately, prioritising internet-facing and mission-critical systems, rather than relying on temporary mitigations.Apache Log4j Vulnerability Guidance
The failure pattern
Watch the pattern: Known vulnerability left unremediated
Safeguards that address it
CollectSEA's engineering analysis of what would have prevented or contained this failure.
- Maintain a software bill of materials and patch fastKnow where each library runs so an emergency fix can be applied within hours.
- Do not interpret untrusted input as lookups or codeDisable dangerous features such as remote JNDI lookups and restrict outbound connections from servers.
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
- ASI03 Identity and Privilege Abuse
- LLM03 Excessive Agency
- AC-3 Access Enforcement
- AC-5 Separation of Duties
- AC-6 Least Privilege
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- RV.1.1 Gather vulnerability information from public sources
- RV.2.2 Plan and implement risk responses
- RV.3.4 Update the development process
- MAP 5.1 Estimate impacts from past uses and public incident reports
- Goal 4 Security patches
- CWE-862 Missing Authorization
- CWE-1395 Dependency on Vulnerable Third-Party Component
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
"ToolShell" vulnerabilities in on-premises SharePoint are exploited to steal server keys (2025)
Microsoft observed attackers exploiting on-premises SharePoint Server vulnerabilities (CVE-2025-53770 and CVE-2025-53771, related to CVE-2025-49704 and CVE-2025-49706) against internet-facing servers, with attempts as…
SQL injection in MOVEit Transfer exploited by the CL0P ransomware gang (2023)
CISA and the FBI report that the CL0P ransomware gang exploited a SQL injection vulnerability (CVE-2023-34362) in Progress MOVEit Transfer beginning May 27, 2023, installing a web shell called LEMURLOOT.
Capital One cloud breach and an $80 million OCC penalty for weak cloud-migration risk assessment (2019)
The OCC assessed an $80 million civil money penalty against Capital One for failing to establish effective risk assessment processes before migrating significant IT operations to the public cloud and for not correcting…
Unpatched web-application vulnerability (Apache Struts) leads to the Equifax breach (2017)
Apache Struts CVE-2017-5638 parser bug left unpatched for 2 months; attackers executed arbitrary commands and accessed unencrypted databases of 147M Americans.
F5, Inc. discloses a cybersecurity incident with data taken without authorization (SEC 8-K, October 2025)
On August 9, 2025, F5, Inc. (the “Company”, “F5”, “we”, or “our”) learned that a highly sophisticated nation-state threat actor had gained unauthorized access to certain Company systems.
GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)
A pull-request title validation workflow used pullrequesttarget, which runs with repository secrets, and echoed the unsanitized PR title, creating an injection point; the workflow's token also had read/write permissions.