What is the risk of Log4j?

• A. High impact
• B. Full system compromise
• C. No impact
• D. Low impact

Answer: (B)

Log4j's risk comes from a remote code execution flaw that lets an attacker run arbitrary code on a server just by processing crafted input. If a vulnerable application uses Log4j and is exposed to untrusted data, an attacker can gain control of the host without authentication, and then install backdoors, steal data, or move to other systems. The severity hinges on the privileges of the Log4j process and the network the host sits on; with high privileges or critical servers, this can lead to taking over the entire system. Because the worst-case outcome is complete control of the affected machine, this risk is best described as a full system compromise. The other options underestimate the danger by implying little to no impact, which doesn’t reflect the potential for full takeover in real-world scenarios.