Apache log4net EUVD-2026-93870

Exploitation requires that the target application be configured to use the RemoteSyslogAppender (explicitly stated: 'Only applications that use RemoteSyslogAppender are affected') and run an affected log4net version from 1.2.12 up to but not including 3.5.0. The attacker must be able to influence a value that gets written into a log message (e.g., a user-supplied username or other field reaching the record). The key limiting factor is the non-default appender dependency - deployments using file/console/other appenders are not affected - and the impact ceiling is integrity of the audit record only (masking/spoofing or dropping of non-ASCII and control characters), with no confidentiality or availability effect. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N).

This is a genuine but low-severity log-integrity issue, not a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3 Medium) is internally consistent with the description: the only impact is Integrity-Low (C:N, A:N), reflecting silent corruption/masking of log records rather than data theft or code execution. No KEV listing and no POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is a correctness/escaping defect (CWE-116), not a memory-safety or RCE bug. There is no EPSS score and no SSVC decision data in the input, so automatability and exploitation-probability signals are UNKNOWN and cannot be weighed. Note a labeling tension: the Tags mark this 'Information Disclosure,' but the CVSS vector sets C:N and I:L, meaning the real effect is integrity (log forging/masking), not confidentiality disclosure - treat the 'Information Disclosure' tag as unreliable. The practical risk is confined to audit-trail trustworthiness in the subset of deployments that actually use RemoteSyslogAppender, so the real-world priority is modest despite the network attack vector.

An attacker submits input (e.g., a username) containing non-visible characters such as a zero-width space - 'admin\u200b' - to an application that logs via Apache log4net's RemoteSyslogAppender. Because every character outside visible ASCII and space was silently deleted rather than escaped, the forwarded syslog record shows an identical-looking 'admin', letting the attacker impersonate or obscure an identity in the audit trail and inject/strip control characters like tabs. No public exploit code is identified at time of analysis; exploitation requires only that attacker-influenced data reaches a logged message.