# CVE-2021-44228 - No actions required for CommCare hosted systems

**URL:** <https://forum.dimagi.com/t/cve-2021-44228-no-actions-required-for-commcare-hosted-systems/8637>\
**Category:** Maintainer Announcements\
**Created:** [December 14, 2021, 5:43pm UTC](https://forum.dimagi.com/t/cve-2021-44228-no-actions-required-for-commcare-hosted-systems/8637 "2021-12-14T17:43:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Clayton\_Sims](https://dimagi.b-cdn.net/user_avatar/forum.dimagi.com/clayton_sims/32/496_2.png) [@Clayton\_Sims](https://forum.dimagi.com/u/Clayton_Sims)\
**Post date:** [December 14, 2021, 5:43pm UTC](https://forum.dimagi.com/t/cve-2021-44228-no-actions-required-for-commcare-hosted-systems/8637/1 "2021-12-14T17:43:26Z")

</div>

This is a notification that **no action is required** for a standard hosted instance of CommCare in response to the recently discovered [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228).

Dimagi's teams reviewed all elements of the CommCare hosted stack on Friday Dec 10 immediately after the exploit was announced. Our inventory confirmed that no elements of the CommCare Java codebases use the vulnerable component, and similarly no other distributed Java services deployed through CommCare Cloud were affected. There was no window in time in which the stack was vulnerable to the reported exploit, so no updates or patches are necessary.

We strongly recommend that administrators review any other software components outside of those managed by CommCare Cloud to ensure that they are patched or unaffected.