You may be aware of the recent vulnerability discovered in the widely used open source logging library Apache log4j (the exploit listed as CVE-2021-44228, and the follow up CVE-2021-45046). We became aware of this issue at 2021-12-11 14:42 UTC and our Tech team enacted our rapid incident response protocol over the weekend to assess the impact on our systems. We determined that the ORCID Registry was among the systems that could be affected and took steps to immediately mitigate any possible threat, patching all affected servers. In addition, our externally accessible endpoints are protected by Cloudflare, which automatically applied changes to prevent any exploitation of the vulnerability at an early stage in the event.
We have also taken action to engage with third parties and critical vendors to address potential vulnerability and ensure a secure path forward. Due to the widespread nature of the Log4j vulnerability, our Tech team will continue to monitor for evidence of any security exploits due to Log4J and will treat its remediation as our highest priority. However at this time we are confident that our systems are safe and intact. We will provide further updates as and when we learn any new information.