How severe is CVE-2026-40023?

CVE-2026-40023 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2026-40023 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (39th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-40023?

CVE-2026-40023 affects Apache Log4cxx. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-40023?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-40023 have an EU (EUVD) identifier?

Yes. CVE-2026-40023 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-21490.

When was CVE-2026-40023 published?

CVE-2026-40023 was published on 2026-04-10 and last updated on 2026-06-17.

CVE-2026-40023

CVE-2026-40023 is a medium-severity vulnerability in Apache Log4cxx with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-116.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 6.3
EPSS exploit prediction: 0% (39th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-21490
Weakness: CWE-116
Affected product: Apache Log4cxx
Published: 2026-04-10
Last modified: 2026-06-17

Description

Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.

Frequently asked questions

What is CVE-2026-40023?: Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
How severe is CVE-2026-40023?: CVE-2026-40023 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2026-40023 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (39th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-40023?: CVE-2026-40023 affects Apache Log4cxx. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-40023?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-40023 have an EU (EUVD) identifier?: Yes. CVE-2026-40023 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-21490.
When was CVE-2026-40023 published?: CVE-2026-40023 was published on 2026-04-10 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:log4cxx:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Log4cxx

CVE-2023-31038 — High (CVSS 8.8): SQL injection in Log4cxx when using the ODBC appender to send log messages to a database. No fields sent to the…
CVE-2025-54813 — High (CVSS 7.5): Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes…
CVE-2025-54812 — Medium (CVSS 5.4): Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not…

All CVEs affecting Apache Log4cxx →

Other CWE-116 vulnerabilities

CVE-2025-55730 — Critical (CVSS 10.0): XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in…
CVE-2025-55729 — Critical (CVSS 10.0): XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in…
CVE-2023-47143 — Critical (CVSS 10.0): IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection,…
CVE-2023-26472 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with…
CVE-2022-41934 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with…
CVE-2022-36100 — Critical (CVSS 9.9): XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform.…

Browse all CWE-116 vulnerabilities →