Skip to page content

AEGLIX MIND

Intelligence for Africa and the Gulf

AEGLIX vulnerability intelligence

CVE-2026-34477

MEDIUM · CVSS 6.3 · Analyzed

Published: 2026-04-10 · Updated: 2026-10-26 · Source: NVD

Stored catalog record

Source record retrieved 2026-10-28T10:18:46.437424+00:00. Scheduled imports handle updates; this page does not assert that the provider was queried just now.

Vulnerability overview

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element. Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value. A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met: * An SMTP, Socket, or Syslog appender is in use. * TLS is configured via a nested <Ssl> element. * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Patch review priority

Assess exposure and vendor guidance

  • No higher-priority signal is available in the current stored evidence.

FIRST EPSS: 0.56% · percentile 46.4 · score date 2026-10-27.

EPSS estimates probability of exploitation in the next 30 days. It does not measure your exposure or prove exploitation. The elevated threshold is 10%; CISA KEV takes precedence. About FIRST EPSS ↗

Severity and scoring

CVSS score
6.3 · MEDIUM
CVSS version
4.0
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-295, CWE-297

CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.

Known exploitation and remediation

Not listed in the CISA catalog retrieved for this record. This does not establish that exploitation has not occurred.

Verify affected versions and patch availability in the vendor advisory before making changes.

Affected products and versions

  • cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*

    From (inclusive): 2.12.0

    Before (exclusive): 2.25.4

  • cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*

  • cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*

  • cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*

  • cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*

  • cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*

  • cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*

These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.

Advisories and references

Explore official sources

Read the official NVD record ↗

Explore the CISA catalog ↗

Back to CVE intelligence