# Patch log4j vulnerability on Windows

**URL:** https://discuss.elastic.co/t/patch-log4j-vulnerability-on-windows/292679
**Category:** Elasticsearch
**Created:** [December 22, 2021, 12:38pm UTC](https://discuss.elastic.co/t/patch-log4j-vulnerability-on-windows/292679 "2021-12-22T12:38:57Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)
#### Post date: [December 22, 2021, 2:15pm UTC](https://discuss.elastic.co/t/patch-log4j-vulnerability-on-windows/292679/2 "2021-12-22T14:15:09Z")

</div>

> [@Erni](#):
>
> I was following instructions from: [Elasticsearch 5.0.0-5.6.10 and 6.0.0-6.3.2: Log4j CVE-2021-44228, CVE-2021-45046 remediation](https://discuss.elastic.co/t/elasticsearch-5-0-0-5-6-10-and-6-0-0-6-3-2-log4j-cve-2021-44228-cve-2021-45046-remediation/292054)

This document is for a different version of elasticsearch that you're using.  
Please read the main post about this vulnerability: [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476)

> [@](#):
>
> The simplest remediation is to set the [JVM option](https://www.elastic.co/guide/en/elasticsearch/reference/7.16/advanced-configuration.html#set-jvm-options) -Dlog4j2.formatMsgNoLookups=true and restart each node of the cluster.

---

_[View the full topic](https://discuss.elastic.co/t/patch-log4j-vulnerability-on-windows/292679)._