The vulnerability of the Log4j1XmlLayout component in the Apache Log4j Core logging library, which allows attackers to influence the integrity of protected information.

🗓️ 15 Apr 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Log4j1XmlLayout flaw in Apache Log4j Core enables improper encoding, risking data integrity.

Reporter	Title	Published	Views	Family All 122
IBM Security Bulletins	Security Bulletin: Vulnerability pyopenssl, jackson-core, pyasn, log4j-core, handlebars, twisted, bcpkix-jdk18on, Mako, httpd, apache2-build, wheel, click, moment-timezone-with-data, urllib, pip July 2026	27 Jul 202616:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j	31 Jul 202608:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Scheduler Optimizer uses log4j-core-2.25.3.jar which is vulnerable to CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480	7 Jul 202613:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple log4j related security vulnerabilities in IBM Guardium Key Lifecycle Manager	13 Jul 202609:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Log4j	6 Aug 202618:39	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Apache Log4j	1 Jul 202605:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow containers July 2026	5 Aug 202607:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	19 Jun 202608:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in log4j-core (CVE-2026-34479)	20 Jul 202614:21	–	ibm
IBM Security Bulletins	Security Bulletin: Log4j Core TLS hostname verification bypass via verifyHostName XML attribute allows man-in-the-middle attacks on SMTP/Socket/Syslog appenders.	29 Jun 202613:33	–	ibm

Vulners

Node

apache apache_log4j_coreRange2.7–2.25.4

apache apache_log4j_coreRange3.0.0-alpha1–3.0.0-beta2

apache apache_log4j_core_2Range2.7–2.25.4

apache apache_log4j_core_2Range3.0.0-alpha1–3.0.0-beta2

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/04/10/8
github	www.github.com/apache/logging-log4j2/pull/4078
lists	www.lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on
web	www.web.nvd.nist.gov/view/vuln/detail

15 Apr 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 36.5

CVSS 27.8

EPSS0.00535