Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2021-4104

HighPublished

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

Published: Dec 14, 2021
Updated: May 28, 2026
Assigning CNA: apache
Evidence observed: Aug 8, 2026

Primary CVSS

7.5/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

81.1%

High · next 30 days

Percentile: 99.6%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Sources

log4shell_1.xPoC
log4j 1.x RCE Poc -- CVE-2021-4104
log4j-CVE-2021-4104PoC
Proof-of-concept exploit for Log4j RCE (CVE-2021-4104) targeting JMS-enabled environments with modified log4j.properties. Demonstrates remote code execution in Log4j 1.x.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.