No updates as of 12/12/2021 10.00am PST.

Here is Adobe's response on the issue. They need time to figure out if log4j 1.2.17 that is inside AEM is affected by this security flaw. [Q1] Is Adobe aware of this Apache log4j library vulnerability?[Adobe] Yes. Adobe is aware of this Apache log4j library vulnerability. [Q2] Does Adobe use the Apa...

If you look at /system/console/bundles, there is a SLF4J over LOG4J bundle in there and Log4J version 1.2.17. Currently, the issues seem to affect log4j 2.x.. it is unclear if 1.2.17 has any vulnerability. I submitted a P1 critical issue to Adobe to see what they have to say.