Java source code for an application should be inspected for the use of vulnerable Log4J versions (< 2.16). To protect applications, vulnerable libraries should be replaced with a patched Log4j 2.3.1 (for Java 6), 2.12.3 (for Java 7), or 2.17.0 (for Java 8 and later).