Sonatype

Log4j2 Deserialization Bypass Enables Remote Code Execution

First seen 27 Aug 2026, 18:50 UTC • •57.1

Article Content

1 / 9

Browse articles

ThreatCluster •August 28, 2026 at 18:24 UTC

•Log4j2 versions 2.11.0 to 2.26.1 are vulnerable to RCE via deserialization.
•Exploitation requires deserializing LogEvent objects from untrusted sources.
•No CVE assigned yet, but organizations should review their configurations.

Recent research has revealed a vulnerability in Apache Log4j2 that allows remote code execution (RCE) through unsafe Java deserialization. The issue affects versions 2.11.0 to 2.26.1 of log4j-api and 2.8.0 to 2.26.1 of log4j-core, specifically in configurations that deserialize serialized LogEvent objects from untrusted sources. This vulnerability exploits the FilteredObjectInputStream, which is intended to restrict deserialization of untrusted data. However, an attacker can use a java.rmi.MarshalledObject to bypass these restrictions, leading to potential code execution. The vulnerability is not classified as a general flaw in Log4j but rather a consequence of specific application behavior. No CVE has been assigned yet, and the risk is considered narrower than the infamous Log4Shell vulnerability. Organizations are advised to investigate their use of serialized LogEvent receivers to mitigate potential risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 44d ago How this analysis works

Timeline

2021-12-10

CVE-2021-44228 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

MITRE

2026-08-24

Researcher discloses Log4j2 deserialization issue

A researcher reported a vulnerability involving unsafe deserialization of LogEvent objects to Apache Log4j, leading to potential RCE.

Fieldeffect

2026-08-27

Sonatype issues advisory on Log4j RCE

Sonatype published an advisory indicating that the reported Log4j RCE is not a clear vulnerability but rather a bypass of existing controls.

Sonatype

2026-08-27

Pruva publishes proof-of-concept

Pruva released a PoC demonstrating the deserialization bypass in Log4j2, confirming the vulnerability's existence under specific conditions.

Pruva

2026-08-27

Ccb.Belgium.Be warns of Log4j2 RCE risk

Ccb.Belgium.Be issued a warning about the potential for RCE via unsafe Java deserialization in Log4j2, urging organizations to assess their configurations.

Ccb.Belgium.Be