# Log4j vulnerability in Elastic Search 7.16.1 **URL:** \ **Category:** Elasticsearch\ **Created:** [April 20, 2022, 2:20am UTC](https://discuss.elastic.co/t/log4j-vulnerability-in-elastic-search-7-16-1/302760 "2022-04-20T02:20:18Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![olilam](https://avatars.discourse-cdn.com/v4/letter/o/c6cbf5/32.png) [@olilam](https://discuss.elastic.co/u/olilam)\ **Post date:** [April 20, 2022, 2:20am UTC](https://discuss.elastic.co/t/log4j-vulnerability-in-elastic-search-7-16-1/302760/1 "2022-04-20T02:20:18Z")
Hi, Our vulnerability scanning tool is detecting Elasticsearch-sql-cli-7.16.1.jar in the bin folder as vulnerable and the jar file contains a Jndilookup.class file. Is it supposed to be detected as vulnerable? Can anyone please advise? Thank you, Oliver ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 20, 2022, 3:08am UTC](https://discuss.elastic.co/t/log4j-vulnerability-in-elastic-search-7-16-1/302760/2 "2022-04-20T03:08:57Z")
Please read through [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#elasticsearch-announcement-esa-2021-31-29) and let us know if you have any questions after that ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 18, 2022, 3:09am UTC](https://discuss.elastic.co/t/log4j-vulnerability-in-elastic-search-7-16-1/302760/3 "2022-05-18T03:09:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.