There is a lot of discussion around the Log4J CVE in the community. If you haven’t heard or read about it then below is the good read

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001391

Versions not affected 

• Sitecore XP 9.1 and earlier versions are not affected by this vulnerability.
• Sitecore Managed Cloud customers who host Solr using SearchStax are not affected by the issue.
• Sitecore XP and Managed Cloud customers who do not use Solr are not impacted.
• The vulnerability does not impact the Azure Search engine.

Solution to fix it:

• Upgrade to Solr 8.11.1 or greater (when available), which will include an updated version of the log4j2 dependency.
• Manually update the version of log4j2 on your runtime classpath and restart your Solr application.
• (Windows) Edit your solr.in.cmd file to include: set SOLR_OPTS=%SOLR_OPTS% -Dlog4j2.formatMsgNoLookups=true

Reference link – https://solr.apache.org/security.html#apache-solr-affected-by-apache-log4j-cve-2021-44228

We fixed it quickly by following the third solution as our SOLR endpoints were not exposed to internet but the best solution is to upgrade the SOLR.

Hope it helps..

Thank you.. Keep Learning.. Keep Sitecoring..