CVE-2021-35587

KEVOracle Fusion Middleware Unspecified Vulnerability

Description

Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedJan 19, 2022

Last modifiedJun 17, 2026

Added to KEVNov 28, 2022

Remediation dueDec 19, 2022

References

oracle.com/security-alerts/cpujan2022.htmlVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1408 days
CVSS: 9.8 CRITICAL
EPSS (30-day exploit probability): 96.3% · top 1% of all CVEs
Weakness: NVD-CWE-Other
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.