sonatype-2026-006746 Security Details

CVE ID

sonatype-2026-006746

CWE

N/A

CVE Description

Log4j - Remote Code Execution (RCE)

Published

Aug 26, 2026

CVSS Score & Severity

9.2Critical

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS Score

0%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/logging/log4j/core/impl/Log4jLogEvent$LogEventProxy.marshall(Lorg/apache/logging/log4j/message/Message;)Ljava/rmi/MarshalledObject;

JVMVulnerable params: 0

org/apache/logging/log4j/core/impl/Log4jLogEvent$LogEventProxy.message()Lorg/apache/logging/log4j/message/Message;

JVM

org/apache/logging/log4j/core/impl/Log4jLogEvent$LogEventProxy.readResolve()Ljava/lang/Object;

JVM

org/apache/logging/log4j/core/impl/Log4jLogEvent$LogEventProxy.writeObject(Ljava/io/ObjectOutputStream;)V

JVM

org/apache/logging/log4j/core/util/FilteredObjectInputStream.isAllowedByDefault(Ljava/lang/String;)Z

JVMVulnerable params: 0

org/apache/logging/log4j/core/util/FilteredObjectInputStream.resolveClass(Ljava/io/ObjectStreamClass;)Ljava/lang/Class;

JVMVulnerable params: 0

org/apache/logging/log4j/util/FilteredObjectInputStream.isAllowedByDefault(Ljava/lang/String;)Z

JVMVulnerable params: 0

org/apache/logging/log4j/util/FilteredObjectInputStream.resolveClass(Ljava/io/ObjectStreamClass;)Ljava/lang/Class;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

Sonatype

References

archive.phPROJECT

GitHub · Issue #4255PROJECT

GitHub · PR #4274PROJECT

GitHub · dinosn/log4j-4255THIRD_PARTY

securityonline.infoTHIRD_PARTY

sonatype.comTHIRD_PARTY