VDB

CVE-2026-24316

CVE-2026-24316 PUBLISHED CVSS 6.400000095367432 MEDIUM

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

EPSS 0.04% · 12.3th percentile

Risk Scores

CVSS 3.1
6.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS Score
0.04%
12.3th percentile

Affected Products

VendorProductVersions
Apache Software FoundationLog4jversions up to 1.2.17
SAP_SESAP NetWeaver Application Server for ABAPSAP_BASIS 740, SAP_BASIS 751, SAP_BASIS 752

Exploit Intelligence

…and 311 more exploits

Timeline

  • Jun 28, 2021 PoC Published
  • Dec 10, 2021 PoC Published
  • Dec 11, 2021 PoC Published
  • Dec 13, 2021 PoC Published
  • Jun 7, 2022 PoC Published
  • Sep 16, 2022 PoC Published
  • Nov 21, 2023 PoC Published
  • Dec 8, 2023 PoC Published
  • Dec 11, 2023 PoC Published
  • Mar 1, 2024 PoC Published
  • Apr 5, 2024 PoC Published
  • Jul 17, 2024 PoC Published

References

…and 97 more

Open in Interactive Console →
$ Console Community · 100/wk Open console ›