Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-
    list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-
    list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification
    https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that
    may carry attacker-influenced data. This causes an exception during serialization and the silent loss of
    the affected log event. An attacker who can influence any of these fields can exploit this to suppress
    individual log records, impairing audit trails and detection of malicious activity. Users are advised to
    upgrade to Apache Log4net 3.3.0, which fixes this issue. (CVE-2026-40021)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-     list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-     list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification     https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that     may carry attacker-influenced data. This causes an exception during serialization and the silent loss of     the affected log event. An attacker who can influence any of these fields can exploit this to suppress     individual log records, impairing audit trails and detection of malicious activity. Users are advised to     upgrade to Apache Log4net 3.3.0, which fixes this issue. (CVE-2026-40021)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
440340	SCA: security update for log4net (GHSA-4f7c-pmjv-c25w)	Tenable Cloud Security	SCA Checks	medium
440340	SCA: security update for log4net (GHSA-4f7c-pmjv-c25w)	Tenable Self-Hosted Container Security	SCA Checks	medium
306027	Linux Distros Unpatched Vulnerability : CVE-2026-40021	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-40021

medium

Tenable Plugins

medium

medium

medium