Impact of the Log4j vulnerability CVE-2021-44228

Background

Log4j is an open source logging library for Java developed by the Apache Foundation, which is widely used in server infrastructure, applications and digital services.

Log4j versions before 2.15.0 have a critical security vulnerability (CVE-2021-44228) allowing remote code execution.

Desktop apps

None of our desktop software on Mac or Windows uses Java or Log4j, so is not affected by CVE-2021-44228.

OnDemand cloud app

None of our cloud software uses Java or Log4j, so is not affected by CVE-2021-44228.

Note: OnDemand runs on Microsoft Azure. Microsoft documented a small number of Azure services that used Log4j, but OnDemand does not use any of those services.

Microsoft’s Response to CVE-2021-44228

Infrastructure

None of our core infrastructure uses Java or Log4j, so is not affected by CVE-2021-44228.

Other services

Assessment of Log4j use by third party suppliers for services like accounting found no impact on our services.

Note: This page covers a historic vulnerability. Log4j was fixed upstream in December 2021, and this assessment is complete, so the page is no longer updated.

Applies to: All products

Last reviewed: October 22, 2026