WinSCP does not use Log4j. And it never did, in any version.

WinSCP is coded in C++/C/Pascal/C#.
There's not a single line of Java code in WinSCP. So WinSCP cannot even use Log4j.

For a list of libraries actually used by WinSCP, see:
https://winscp.net/eng/docs/contributions

We are in the same situation – We need to know wether yes or no but do not find any information around.
Here are some more informations:
<invalid hyperlink removed by admin>
https://github.com/NCSC-NL/log4shell/tree/main/software
Yours
Roland

We use WinSCP at our company (version 5.15).
Due to the current situation, we have the following question, for which we need a quick feedback:
Is the WinSCP we use affected by this vulnerability or does it use this library?