[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Vendor Risk Management](/category/vendor-risk-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [The Apache Log4J Vulnerability: Questionnaire & VRM Tips](/blog/log4j-vulnerability-questionnaire) Publish date January 16, 2025 {x} minute read # The Apache Log4J Vulnerability: Questionnaire & VRM Tips [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Nicholas Sollitto](/team/nicholas-sollitto) Senior Cybersecurity Writer Nicholas's cybersecurity writing has been featured in G2. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) [Apache Log4j 2](https://www.upguard.com/blog/apache-log4j-vulnerability), a Java-based logging library, was affected by a [zero-day vulnerability](https://www.upguard.com/blog/zero-day) on December 9, 2021. The vulnerability, known as Log4Shell and identified by the [National Institute of Standards and Technology (NIST)](https://www.upguard.com/resources/nist-compliance-guide) as CVE-2021-44228, allows cybercriminals to take control of vulnerable systems and servers. Many web applications, open-source cloud platforms, and service providers utilize Log4j. This widespread use could expose your organization’s internal [attack surface](https://www.upguard.com/blog/attack-surface-management) and third-party ecosystem to the Log4Shell vulnerability. To secure critical systems and data effectively, your organization needs to assess its internal use of Log4j and its vendor’s use of the logging library. Keep reading to discover 11 questions your [vendor risk management](https://www.upguard.com/blog/vendor-risk-management) team can use to determine how [vendors](https://www.upguard.com/blog/third-party-vendor) use Log4j across your [third-party supply chain](https://www.upguard.com/blog/what-is-supply-chain-risk-management) and how this could impact your organization’s [security posture](https://www.upguard.com/blog/security-posture). [Learn more about UpGuard Vendor Risk: the world’s #1 vendor risk management solution>](https://www.upguard.com/product/vendorrisk) ## Summary of the Log4Shell Vulnerability In December 2021, security researchers announced a critical security flaw in the Apache Log4j framework, allowing [malicious hackers](https://www.upguard.com/blog/how-hackers-can-bypass-mfa) to compromise vulnerable systems through a single code injection. During the first days of impact, security researchers identified approximately [10 million Log4Shell exploitation attempts](https://www.wsj.com/articles/what-is-the-log4j-vulnerability-11639446180) every hour. Various industries are vulnerable to Log4Shell because many digital products and software, including Microsoft and IOS applications, utilize Java. The retail industry was the most affected by the Log4Shell vulnerability, but other sectors, including [technology](https://www.upguard.com/industries/technology), [financial services](https://www.upguard.com/industries/financial-services), manufacturing, and [healthcare](https://www.upguard.com/industries/healthcare), were also affected. ### Patching the Log4J Vulnerability Apache began developing a patch for Log4Shell quickly after it became aware of the vulnerability in December 2021. However, Log4j still presents significant security risks, given its widespread use. Any version of Log4j 2 earlier than 2.17.1 is vulnerable to the Log4Shell vulnerability. To effectively protect themselves against this vulnerability, organizations must address any vulnerable version of Log4j 2 in use across their internal infrastructure and third-party ecosystems. Security teams can follow the following protocol to address the vulnerability: 1. Update to the latest version of Log4j 2 2. Run vulnerability scans using a scanner 3. Update [Java system properties](https://www.upguard.com/blog/top-10-java-vulnerabilities-and-how-to-fix-them) 4. Disable JNDI 5. Send an [Apache Log4j questionnaire](https://www.upguard.com/product/security-questionnaires) to vendors 6. Employ [multi-factor authentication](https://www.upguard.com/blog/mfa-multi-factor-authentication) **Recommended Reading: **[Log4Shell: The Log4J Vulnerability Clearly Explained](https://www.upguard.com/blog/apache-log4j-vulnerability) ### Related Log4J Vulnerabilities While Apache worked to resolve the Log4Shell vulnerability, researchers and threat actors discovered additional flaws in various versions of Log4j. NIST has identified these flaws with the following codes: * **CVE-2021-45046: **Allows cybercriminals to send malicious JNDI lookups, present in Log4j 2.15 and below - **CVE-2021-45105**: Allows cybercriminals to deploy [denial-of-service attacks](https://www.upguard.com/glossary/ddos-attack#:~:text=A%20Distributed%20Denial%2Dof%2DService,together%20to%20create%20a%20botnet.) through malicious messages, present in Log4j 2.16 and below  **CVE-2021-44832**: A remote code execution vulnerability (RCE) that allows hackers to exploit systems with arbitrary code if they have elevated permissions, present in Log4j 2.17 and below ## 11 Apache Log4J Questions To Ask Your Vendors [Security questionnaires](https://www.upguard.com/blog/security-questionnaire) are one of the most effective ways an organization can evaluate the [security posture](https://www.upguard.com/blog/using-chatgpt-to-improve-cybersecurity-posture) of its third-party vendors. Your organization can use the following 11 questions to create a security questionnaire to identify any outdated versions of Log4j across its entire vendor ecosystem. [Discover UpGuard’s robust security questionnaire library>](https://www.upguard.com/product/security-questionnaires) **1. Does your organization run any version of Log4j 2?** * Yes * No * \[Open text field for vendor comments] **2. Has your organization updated to Log4j 2.17.1 as the Apache Software Foundation and CISA recommended?** * Yes, the organization has updated to Log4j 2.17.1 * No, the organization is unable to update to Log4j 2.17.1 (please explain below) * The organization has not yet updated to Log4j 2.17.1 * \[Open text field for vendor comments] **3. If no, what version of Log4j 2 does your organization currently run?** * The organization utilizes a version of Log4j 2 between 2.7 and 2.14.1 (proceed to question 3) * The organization utilizes a version of Log4j 2 between 2.0-beta9 and 2.10.0 (proceed to question 4) * The organization utilizes Log4j 2**.**17.1 **4. If your organization utilizes a version of Log4j2 between 2.7 and 2.14.1, have the following mitigation efforts been implemented:** **‍**a) Either the system property, log4j2.formatMsgNoLookups, or the environment variable, LOG4J\_FORMAT\_MSG\_NO\_LOOKUPS, have been set to true AND b) All PatternLayout patterns have been modified to %m{nolookups} instead of just %m * The organization has implemented precaution a) * The organization has implemented precaution b) * The organization has implemented precautions a) and b)  * \[Open text field for vendor comments] **5. If your organization utilizes a version of Log4j2 between 2.0-beta9 and 2.10.0, have the following mitigation efforts been implemented:** **‍**a) Either the system property, log4j2.formatMsgNoLookups, or the environment variable, LOG4J\_FORMAT\_MSG\_NO\_LOOKUPS, have been set to true AND b) The JndiLookup class has been withdrawn from path: zip -q -d log4j-core-\*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class. * The organization has implemented precaution a) * The organization has implemented precaution b) * The organization has implemented precautions a) and b)  * \[Open text field for vendor comments] **6. Did your organization use CISA’s GitHub repository to identify assets vulnerable to Log4Shell?** * Yes * No * \[Open text field for vendor comments] **7. Has your organization identified any indicators of compromise (IOCs) resulting from the Log4Shell vulnerability?** * Yes (please list below) * No * \[Open text field for vendor comments] **8. How did the Log4Shell vulnerability impact your organization?** * The vulnerability didn’t affect the organization, and we were not exposed to any cyber attacks or security issues resulting from the vulnerability * The vulnerability moderately affected the organization, but no critical systems, infrastructure, services, or data were impacted (please explain below) * The vulnerability directly affected the organization’s critical systems, infrastructure, services, and/or data (please explain below) * \[Open text field for vendor comments] **9. Does your organization have an incident response plan to respond to cyber threats?** * Yes, the organization has an incident response plan in place * The organization is in the process of finalizing a dedicated incident response plan * No, the organization does not have an incident response plan in place * \[Open text field for vendor comments]**‍** **10. How often does your organization deploy in-depth risk assessments to appraise internal security vulnerabilities?** * Annually * Every six months * As needed, or we do not have a scheduled cadence for risk assessments * \[Open text field for vendor comments] **11. Who is your organization's point of contact to field additional questions and queries?** * Name: * Title: * Email: * Phone: * \[Open text field for vendor comments] ## How To Remediate Vendor Risks If your organization deploys an Apache Log4j security questionnaire and finds a vendor is running a vulnerable version of Log4j 2, you must fix the risk immediately. Your organization should [prioritize remediation](https://www.upguard.com/blog/vulnerability-remediation) efforts based on [vendor criticality](https://www.upguard.com/blog/what-is-vendor-tiering) if multiple vendors are exposed. Depending on the vendor’s level of security awareness, your organization may need to work alongside the vendor’s security team to deploy necessary updates and remediation protocols. Your team can follow the following remediation workflow upon identifying an exposed vendor: * Communicate with the identified point of contact and request remediation * Suggest mitigation procedures, such as removing JNDI lookups, updating to the latest version of Log4j, using CISA’s GitHub repository to inventory vendors, and others recommended by Apache and CISA * Communicate expectations, timelines, and advisory consequences for remediation failure * Send a new security questionnaire to verify the risk has been remediated **Recommended Reading: **[Choosing Automated Vendor Risk Remediation Software in 2024](https://www.upguard.com/blog/choosing-automated-vendor-risk-remediation-software#:~:text=UpGuard%20streamlines%20the%20entire%20risk,done%20in%20the%20UpGuard%20platform.) ## How Can UpGuard Help With the Apache Log4J Vulnerability [UpGuard](https://www.upguard.com/) is a cybersecurity company dedicated to helping security teams protect their internal and third-party [attack surfaces](https://www.upguard.com/blog/attack-surface). UpGuard’s two products, [Vendor Risk](https://www.upguard.com/product/vendorrisk) and [Breach Risk](https://www.upguard.com/product/breachsight) allow organizations to improve their [cyber hygiene](https://www.upguard.com/blog/cyber-hygiene), appraise the security posture of individual vendors, and deploy robust vendor risk management and cyber risk management protocols. UpGuard’s vulnerability scanning and vulnerability assessment capabilities allow organizations to identify various vulnerabilities that could impact their security posture and lead to cyber attacks such as [malware](https://www.upguard.com/blog/types-of-malware) or [ransomware](https://www.upguard.com/blog/ransomware). UpGuard Vendor Risk and Breach Risk include the following features: * [**Data leak detection:**](https://www.upguard.com/product/breachsight/features#monitor-data-protection) Protect your brand’s reputation, intellectual property, and customer data with timely detection of data leaks * [**Continuous monitoring:**](https://www.upguard.com/product/breachsight/features#continuous-security-monitoring-section)** **Get real-time updates and manage exposures across your attack surface, including domains, IPs, apps, endpoints, plugins, and firewalls[**‍**](https://www.upguard.com/product/breachsight/features#attack-surface-reduction-section) * [**Attack surface reduction:**](https://www.upguard.com/product/breachsight/features#attack-surface-reduction-section)** **Reduce your attack surface by discovering exploitable vulnerabilities and domains at risk of typosquatting[**‍**](https://www.upguard.com/product/breachsight/features#security-profile-section)** ** * [**Shared security profile:**](https://www.upguard.com/product/breachsight/features#security-profile-section)** **Create an UpGuard Trust Page to eliminate the hassle of answering security questionnaires * [**Workflows and waivers:**](https://www.upguard.com/product/breachsight/features#workflows-waivers-section)** **Streamline remediation workflows, quickly waive risks, and respond to security queries * [**Reporting and insights:**](https://www.upguard.com/product/breachsight/features#reporting-insights-section)** **Access tailor-made reports for different stakeholders and view information about your external attack surface[**‍**](https://www.upguard.com/product/vendorrisk/features#security-questionnaires-section) * [**Vendor Security questionnaires**](https://www.upguard.com/product/vendorrisk/features#security-questionnaires-section)**: **Automate security questionnaires to gain deeper insight into your vendor relationships and third-party security posture[**‍**](https://www.upguard.com/product/vendorrisk/features#security-ratings-section) * [**Security ratings:**](https://www.upguard.com/product/vendorrisk/features#security-ratings-section) Appraise the security posture of individual vendors by using our data-driven, objective, and dynamic security ratings[**‍**](https://www.upguard.com/product/vendorrisk/features#risk-assessment-section) * [**Risk assessments:**](https://www.upguard.com/product/vendorrisk/features#risk-assessment-section)** **Streamline risk assessment workflows, gather evidence, and quickly request remediation Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Vendor Risk Management #### [Vendor Tiering That Scales: A Weighted-Model Implementation Guide](/blog/vendor-tiering-that-scales) UpGuard's guide to vendor tiering at scale: a weighted risk model that tiers vendors objectively and routes high-risk vendors for review automatically. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 13, 2026 Vendor Risk Management #### [The Vendor Tiering Series: Why Tier Your Vendors](/blog/vendor-tiering-why-tier-vendors) When every vendor is a priority, none actually are. Learn how effective vendor tiering defines criticality and maintains a defensible security posture. [](/team/revashni-moodley) [Revashni Moodley](#) February 25, 2026 Vendor Risk Management #### [Building a Robust Vendor Risk Management Dashboard](/blog/vendor-risk-management-dashboard) Discover the importance of building a robust VRM dashboard. This article outlines key features, essential metrics, and best practices. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) September 20, 2026 Third-Party Risk Management #### [The Best Supplier Risk Management Software in 2026](/blog/best-supplier-risk-management-software) Discover the best supplier risk management software in 2026, including UpGuard Vendor Risk, Bitsight, and Riskconect. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 26, 2026 Cyber Risk Posture Management #### [The Best IT and Cyber Risk Management Software](/blog/best-it-and-cyber-risk-management-software) Discover the best IT and cyber risk management software, including UpGuard, Riskonnect, Diligent, Optro, ServiceNow, Archer, and MetricStream. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 3, 2026 Vendor Risk Management #### [Shadow IT: Usage-Based Tiering for Vendor Risk](/blog/shadow-it-tiering-vendor-risk) How UpGuard User Risk and Vendor Risk use real-time usage signals to discover shadow IT and tier every app by true risk profile in 2026. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 26, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)