Two years on, 1 in 4 apps still vulnerable to Log4Shell

Two years after the Log4Shell disclosure, Veracode and Sonatype research shows that a large portion of software remains exposed: roughly 35% of applications are still vulnerable to Log4Shell and nearly 40% are vulnerable to RCE flaws due to outdated Log4j versions, with 26% of recent Log4j downloads containing vulnerable releases; while many organizations patched quickly and exploitation was limited, the report highlights persistent risk from unpatched dependencies and some documented attacks using the flaw.