@bryans3c and I reproduced apache/logging-log4j2 #4255 on official Log4j 2.26.1. It is not Log4Shell.
In our lab, command execution needed a Java-serialized LogEvent receiver and a gadget library already on the JVM. log4j-api and log4j-core were not enough.
Brief generated overview: