What is the security risk of a Log4j remote code execution?

• A. Full system compromise
• B. No impact
• C. Minimal impact
• D. Affects only the server's logger

Answer: (A)

Remote code execution means an attacker can run arbitrary code on the affected server from outside, via the vulnerable logging path. In Log4j’s case, specially crafted log data can trigger a JNDI lookup that loads and runs code from an attacker-controlled source. Once code runs on the host, it inherits the server process’s privileges, giving the attacker the ability to take full control of the machine, access or exfiltrate data, install backdoors, and move laterally to other systems. That level of access is what makes the risk a full system compromise rather than something minor. The other options underestimate the impact—if you can trigger code execution on a server, you typically gain control of that server, not just affect the logger.