Despite months of dire warnings about the threat potential, researchers say the vast majority of vulnerabilities in the widely used Apache Log4j logging utility for Java software remain unpatched and actively exploited. New research suggests that more than 90,000 Internet-facing Java applications and nearly 70,000 servers remain exposed to the flaw that enables attackers to remotely execute code on compromised systems.