Cyber Resilience

CVE-2026-40021

Medium

Published: 10 April 2026

Published
10 April 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score v4 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0075 50.3th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-40021 is a medium-severity Improper Encoding or Escaping of Output (CWE-116) vulnerability in Apache Log4Net. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Disable or Modify Windows Event Log (T1685.001); ranked in the top 49.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data.…

more

This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.

CWE(s)
CWE-116

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1685.001 Disable or Modify Windows Event Log Defense Impairment
Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits.
attack.mitre.org →
Why these techniques?

Vulnerability enables attacker-controlled input to trigger exceptions that silently drop log events, directly facilitating suppression of audit/logging mechanisms (analogous to disabling event logging).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Affected Assets

apache
log4net
≤ 3.3.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-15 Information Output Filtering
addresses: CWE-116

Validating that output matches expected content directly mitigates failures to properly encode or escape data for its destination context.

References