diff --git a/bin/hbase-config.cmd b/bin/hbase-config.cmd
index f0a972815a5..3b7b713abfd 100644
--- a/bin/hbase-config.cmd
+++ b/bin/hbase-config.cmd
@@ -67,10 +67,6 @@ if exist "%HBASE_CONF_DIR%\hbase-env.cmd" (
   call "%HBASE_CONF_DIR%\hbase-env.cmd"
 )
 
-@rem Disable the JNDI. This feature has critical REC vulnerability.
-@rem when 2.x <= log4j.version <= 2.14.1
-set HBASE_OPTS=%HBASE_OPTS% -Dlog4j2.formatMsgNoLookups=true
-
 if not defined JAVA_HOME (
   echo Warning: JAVA_HOME environment variable is not set. Defaulting to c:\apps\java
   set JAVA_HOME=c:\apps\java
diff --git a/bin/hbase-config.sh b/bin/hbase-config.sh
index 5154ee18215..23385d6d6a4 100644
--- a/bin/hbase-config.sh
+++ b/bin/hbase-config.sh
@@ -162,11 +162,7 @@ fi
 # memory usage to explode. Tune the variable down to prevent vmem explosion.
 export MALLOC_ARENA_MAX=${MALLOC_ARENA_MAX:-4}
 
-# Disable the JNDI. This feature has critical REC vulnerability
-# when 2.x <= log4j.version <= 2.14.1
-export HBASE_OPTS="$HBASE_OPTS -Dlog4j2.formatMsgNoLookups=true"
-
-# Now having JAVA_HOME defined is required 
+# Now having JAVA_HOME defined is required
 if [ -z "$JAVA_HOME" ]; then
     cat 1>&2 <<EOF
 +======================================================================+
diff --git a/pom.xml b/pom.xml
index 2ee0b0e79d8..87448a96a63 100755
--- a/pom.xml
+++ b/pom.xml
@@ -1746,7 +1746,7 @@
     <hamcrest.version>1.3</hamcrest.version>
     <opentelemetry.version>1.0.1</opentelemetry.version>
     <opentelemetry-javaagent.version>1.0.1</opentelemetry-javaagent.version>
-    <log4j2.version>2.15.0</log4j2.version>
+    <log4j2.version>2.16.0</log4j2.version>
     <mockito-core.version>2.28.2</mockito-core.version>
     <protobuf.plugin.version>0.6.1</protobuf.plugin.version>
     <thrift.path>thrift</thrift.path>