US cyber-security officials have ordered federal agencies to protect their systems against a major computer vulnerability by Christmas Eve.
The Cybersecurity and Infrastructure Security Agency (CISA) set a 24 December deadline for security patches.
Security experts have called Log4shell one of the most serious security flaws in the past decade.
CISA head Jen Easterly has called it “a severe risk”.
Separately, Microsoft has warned some nation-state hacking groups are using Log4shell.
“Multiple tracked nation-state activity groups originating from China, Iran, North Korea, and Turkey” were using the vulnerability, the company said, for activities ranging from “experimentation” to targeted attacks.
CISA added it to the “Known Exploited Vulnerabilities Catalog” a list of common security flaws that carry significant risk to the federal organisations.
The agency said federal civilian executive-branch agencies must “mitigate” the problem – with IT systems patched with new software – by 24 December.