Incomplete fix for Apache Log4j vulnerability CVSS base score is 3.1 (CRITICAL severity). The EPSS exploit prediction model gives this CVE a 94.3% probability of exploitation in the next 30 days, placing it in the 100th percentile of all tracked vulnerabilities. This vulnerability is on the CISA Known Exploited Vulnerabilities catalog — meaning active in-the-wild exploitation has been confirmed by federal sources. Federal civilian agencies must remediate by May 22, 2023. Affects 6 packages across the dependency graph; review the affected version ranges below and upgrade to a fixed release where available.