A new zero day exploit, popularly known as 'log4shell', has been discovered in versions of log4j2 prior to version 2.15.0.

https://www.veracode.com/blog/security-news/urgent-analysis-and-remediation-guidance-log4j-zero-day-rce-cve-2021-44228

SECCOM recommendation is move to 2.16.0

Apache log4j 2.16.0 release note: 

• Remove Message Lookups.
  While release 2.15.0 removed the ability to resolve Lookups and log messages and addressed issues with how JNDI is accessed, the Log4j team feels that having JNDI enabled by default introduces an undue risk for our users. Starting in version 2.16.0, JNDI functionality is disabled by default and can be re-enabled via the `log4j2.enableJndi` system property. Use of JNDI in an unprotected context is a large security risk and should be treated as such in both this library and all other Java libraries using JNDI.
  Prior to version 2.15.0, Log4j would automatically resolve Lookups contained in the message or its parameters in the Pattern Layout. This behavior is no longer the default and must be enabled by specifying %msg{lookup}.