you could probably fire a bullet in any direction and hit a company with hundreds of apps or appliances affected. I recognize this probably isn't helpful on it

you could probably fire a bullet in any direction and hit a company with hundreds of apps or appliances affected. I recognize this probably isn't helpful on its face, but the best way to think of it is: if it's a Java app (or heck even possibly just an app running on the JVM) that uses the most recent major version (2.x before 2.15.0, the patch) of the most common logging logic, it's affected. And that list in the enterprise space gets exceptionally long. Maybe not so much on client machines, but servers/etc absolutely. Even companies not known for using Java for their own apps are probably relying on appliances or systems which run their own vulnerable Java apps.