AEM 6.5.24.0: Log4j 2.20.0 (log4j-api only) vulnerability scan findings and mitigation guidance
This article clarifies the security impact and required actions for environments where only the Log4j 2.20.0 API bundle is present in Adobe Experience Manager 6.5.24.0.
Description description
Environment
Adobe Experience Manager (AEM) 6.5.24.0 (latest Service Pack)
Issue/Symptoms
A vulnerability assessment scan has flagged the presence of Apache Log4j version 2.20.0 in the AEM environment. The following conditions are observed:
- The OSGi bundle
org.apache.logging.log4j.apiversion 2.20.0 is present in the Felix console (/system/console/bundles). - The
log4j-corebundle is not present in the environment. - The Log4j dependency is introduced by AEM’s internal OSGi bundles, not by custom application code.
The scan reports a high severity vulnerability based on the detected Log4j version, and the user requests clarification on:
- Whether Log4j 2.20.0 (API only) is affected by known exploitable vulnerabilities in this context.
- Whether Adobe has internally mitigated or patched relevant CVEs in this Service Pack.
- Recommendations regarding upgrading Log4j to 2.25.x or later.
- The supported approach for upgrading if required.
- Whether this will be addressed in future Service Packs or Cumulative Fix Packs.
No error messages or stack traces are reported; the concern is based on scanner output and version detection.
Resolution resolution
-
Review the Log4j Bundles Present
- Confirm via
/system/console/bundlesthat onlyorg.apache.logging.log4j.api(API) is present and thatlog4j-coreis not present in the runtime. - Ensure no custom or third-party bundles introduce
log4j-core.
- Confirm via
-
Understand Scanner Findings
- Most vulnerability scanners flag based on version presence, not on actual exploitability. The Log4j API bundle alone does not provide the vulnerable code paths associated with critical CVEs (such as CVE-2021-44228 and CVE-2021-45046).
- Refer to Adobe’s official security advisory for Log4j in AEM: Adobe Log4j Security Advisory
-
Adobe’s Mitigation and Patch Policy
- Adobe delivers security fixes and mitigations through Service Packs, Cumulative Fix Packs, and hotfixes. Manual replacement of Adobe-shipped logging libraries is not recommended or supported.
- For AEM 6.5, remain on the latest supported Service Pack to receive all security updates.
- No separate customer advisory has been published for this specific finding, as the presence of the API bundle alone does not introduce exploitable risk in out-of-the-box AEM.
-
Upgrade Recommendations
- There is no requirement to upgrade Log4j API independently within AEM. Adobe will address any necessary library updates in future Service Packs or Cumulative Fix Packs as needed.
- Do not manually replace or upgrade internal Adobe libraries unless explicitly instructed by Adobe support.
-
Monitor for Updates
- Continue to monitor AEM Release Notes and Adobe Security Bulletins for future updates regarding bundled library versions.
Cause
Vulnerability scanners may flag the presence of Log4j API based on version detection, but without log4j-core in the runtime, the known critical vulnerabilities are not exploitable in standard AEM 6.5.24.0 deployments.