Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise
- :
- Re: log4j exploit - how do I remedy?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello! A recent security scan of our environment has discovered two instances of log4j in our Splunk Enterprise environment (v9.4.2) that have a known "medium" vulnerability. The log4j instances are found in
- "etc/apps/splunk_archiver/java-bin/jars/thirdparty/common/log4j-core-2.17.2.jar"
- "bin/jars/thirdparty/common/log4j-core-2.17.2.jar"
Based on the release notes, this vulnerability is not addressed in any 9.4.x release, up to 9.4.8. And there are no app updates available.
Do we have any options to remedy this? I'm guessing a manual update of log4j would be ill-advised, as my change would simply be overwritten if/when the app is updated.
If anyone has any suggestions, they are greatly appreciated.
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Branden - We also had a similar situation, if this a new vulnerability like CVE is posted recently by your Vulnerability scanner, then we have to wait for Splunk's "Third-Party Package Updates in Splunk Enterprise - February", mostly will be releasing in coming weeks which will cover the solution or workarounds to be applied for third party packages. Meantime, you can do the below things :
- Assess the vulnerability details with your security team to assess the applicability of this risk to your Splunk setup. Understand the risk, impact and clarify your security setup in Splunk deployment.
- Gather the CVE details, when it got released, based on that information you can check in Splunk advisory for past SVDs for older CVEs which will give you mitigation measures.
- Raise a Splunk support case with the CVE details, scan findings (very important) for further assistance.
Hope this helps.
> Marking the answer and giving Karma helps others find solutions faster.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Branden - We also had a similar situation, if this a new vulnerability like CVE is posted recently by your Vulnerability scanner, then we have to wait for Splunk's "Third-Party Package Updates in Splunk Enterprise - February", mostly will be releasing in coming weeks which will cover the solution or workarounds to be applied for third party packages. Meantime, you can do the below things :
- Assess the vulnerability details with your security team to assess the applicability of this risk to your Splunk setup. Understand the risk, impact and clarify your security setup in Splunk deployment.
- Gather the CVE details, when it got released, based on that information you can check in Splunk advisory for past SVDs for older CVEs which will give you mitigation measures.
- Raise a Splunk support case with the CVE details, scan findings (very important) for further assistance.
Hope this helps.
> Marking the answer and giving Karma helps others find solutions faster.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, this is exactly what I need to know.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Go to https://advisory.splunk.com/ and look up the CVE reported by your scanner to see what Splunk says about it. There is a log4j advisory from 2021, but it may not apply to recent versions of Splunk.
If this reply helps you, Karma would be appreciated.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
