Vulnerability threat dossier
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
VTP analyst assessment
CISA KEV lists this Log4j follow-on vulnerability as known exploited globally and notes known ransomware use. Greenbone Community Feed reports public exploit-template availability.
1 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
The flaw requires specified non-default logging configurations.
We do not know whether affected Log4j versions or configurations remain in use.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Review in your environment: if you use Apache Log4j2, check affected versions and non-default Pattern Layout configurations using Context Lookup or Thread Context Map patterns.
Previous AI priority: HIGH → current: HIGH. Inspect the evidence preserved for each run before treating this as a threat transition.
VTP deterministic assessment
CISA KEV lists this vulnerability as known to be exploited globally.
A proof of concept is reported; functional reliability is not established.
EPSS is 1.00; this is predictive context, not exploitation evidence.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Material change ledger
Claim provenance
0 primary sources · 0 dependent secondary reports · 1 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
Greenbone Community Feed published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.
Greenbone Community Feed published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.
ProjectDiscovery Nuclei Templates Releases published evidence linked to CVE-2021-45046.
CISA lists global known exploitation. This is not a VTP sensor observation.
Original publications
Greenbone Community Feed recorded exploit-tooling coverage changes for 2 CVEs in this pinned revision. 2 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.
Greenbone Community Feed recorded exploit-tooling coverage changes for 9 CVEs in this pinned revision. 9 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.
New Templates Added: 122 | CVEs Added: 49 | First-time contributions: 23 🔥 Release Highlights 🔥 [CVE-2026-63030] WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion ( @slcyber , @mielverkerken , @pdteam , @FLX-0x00 ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-60004 ] Gitea <= 1.27.0 - Pre-Auth Remote Code Execution (@0x_Akoko) [critical] 🔥 [ CVE-2026-58455 ] Dockwatch <= 0.6.567 - OS Command Injection ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-56291 ] Balbooa Forms < 2.4.1 - Unauth Arbitrary File Upload ( @nick Vidovic, @0x_Akoko) [critical] (kev) (vKEV) 🔥 [ CVE-2026-56290 ] Page Builder CK <= 3.5.10 - Unauth File Upload ( @panchiko-p , @0x_Akoko) [critical] (kev) (vKEV) 🔥 [ CVE-2026-48908 ] Joomla SP Page Builder <= 6.6.1 - Unauth Arbitrary File Upload RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥 [ CVE-2026-46442 ] Flowise < 3.1.2 - node-custom-function Unauth RCE ( @dhiyaneshdk , @princechaddha ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-44825 ] Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials ( @pdteam , @0x_Akoko) [high] (kev) (vKEV) 🔥 [ CVE-2026-16232 ] Check Point Security Management Server - SmartConsole Authentication Bypass ( @sfewer-r7 , @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-15409 ] SonicWall SMA1000 - Server-Side Request Forgery ( @dhiyaneshdk , @rapid7 ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-9282 ] W3 Total Cache <= 2.9.4 - Unauth Arbitrary File Read (@0x_Akoko) [high] (kev) (vKEV) 🔥 [ CVE-2026-8732 ] WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauth Administrator Account Creation ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-8713 ] Avada (Fusion) Builder <= 3.15.3 - Unauth Arbitrary File Deletion (@rool-machine) [critical] (kev) (vKEV) 🔥 [ CVE-2026-6875 ] ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE ( @pdteam , @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-3296 ] Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2025-71334 ] Flowise - Path Traversal ( @theamanrawat ) [critical] (kev) (vKEV) 🔥 [ CVE-2025-68493 ] Apache Struts XWork - XML External Entity Injection ( @pussycat0x ) [high] (kev) (vKEV) 🔥 [ CVE-2025-54988 ] Apache Tika - XXE Injection ( @tx1ee ) [critical] 🔥 [ CVE-2025-6389 ] Sneeit WP Social WordPress Plugin - Unauth RCE via call_user_func ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2025-2505 ] WordPress Age Gate <= 3.5.3 - Unauth Local File Inclusion ( @pussycat0x ) [critical] (kev) (vKEV) 🔥 [CVE-2024-56511] DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal ( @ChrisJr404 ) [critical] 🔥 [ CVE-2023-34992 ] Fortinet FortiSIEM - Unauth Command Injection ( @Thacien ) [critical] 🔥 What's Changed Bug Fixes Stopped credential-stuffing and token-spray templates from sending their first request when no username, password or token is supplied (PR #16589 , Issue #11238 ). Restored missing matcher and extractor values in four templates that silently no-op'd, including CVE-2021-44228 , CVE-2021-45046 and CVE-2026-42281 (PR #16661 ). Replaced an unsupported RE2 lookahead that stopped home-env-permission.yaml from loading at all (PR #16664 ). Added the missing capture group to three regex extractors (PR #16665 ). Corrected the extractor part in portal-api-ssrf from interactsh to interactsh_request (PR #16667 ). Corrected the DSL variable in thinkphp6-arbitrary-write from status_2 to status_code_2 (PR #16668 ). Unhid two extractors marked internal that nothing consumed (PR #16669 ). Marked the setup-stage matchers in CVE-2025-2075 as internal (PR #16671 ). Removed an AWS access key ID from a reference URL in CVE-2024-51482.yaml (PR #16616 ). Fixed an intrusive tag typo in CVE-2023-34124 .yaml (PR #16675 ). Corrected the id and filename for the IBM DB2 Server template (PR #16688 ). Fixed the severity in directory-listing-no-host-header.yaml (PR #16614 ). Corrected the author field for CVE-2024-23108 (PR #16620 ). Moved CVE-2025-296
Technical vulnerability data
Raw observations
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.