Security researchers from Jfrog have identified a critical remote code execution (RCE) vulnerability within the Java-based open-source relational database management console known as “H2” that has been exploited in-the-wild. The flaw, tracked as CVE-2021-42392, has the same root cause as the devastating Log4Shell vulnerability, which is still being exploited across the world today. Like Log4Shell, CVE-2021-42392 is related to the remote class loading of the Java Naming and Directory Interface (JNDI) API, which provides name and directory functionality for Java-based applications. Ultimately, multiple code pathways within the framework of the H2 database pass unfiltered URLs to the “javax.naming.Context.lookup” function, which allows for remote class loading. If those unfiltered URLs were attacker-controlled, then the threat actor would be able to exploit the vulnerability for RCE. Although critical, this vulnerability will be exploited by threat actors much less than Log4Shell, due to the fact that most users leverage the H2 database from a LAN or Wan. In most distributions of H2, the console only listens to localhost connection, and Jfrog researchers recommend H2 users update to version 2.0.206 of the H2 database. The Ankura CTIX team will continue to monitor this vulnerability and will provide new information to our readers if it becomes known.