{"id":"CVE-2021-35587","aliases":["EUVD-2021-22223","GHSA-x3jv-936g-xqj4"],"status":"published","title":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.96284,"percentile":0.99879,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-306","CWE-502","CWE-790"],"published":"2022-01-19T11:21:42Z","modified":"2026-06-17T03:57:46Z","kev":{"date_added":"2022-11-28","due_date":"2022-12-19","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-11-28"},{"source":"kev","since":"2022-11-28"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/oracle_access_manager_rce_cve_2021_35587","title":"Oracle Access Manager unauthenticated Remote Code Execution","type":"exploit","platform":"Linux,Unix,Windows","date":"2022-01-19","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/oracle_access_manager_rce_cve_2021_35587"},{"source":"pocgithub","id":"ZZ-SOCMAP/CVE-2021-35587","title":"ZZ-SOCMAP/CVE-2021-35587","date":"2022-03-14","url":"https://github.com/ZZ-SOCMAP/CVE-2021-35587"},{"source":"pocgithub","id":"Jwa7470/2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report","title":"Jwa7470/2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report","date":"2026-08-28","url":"https://github.com/Jwa7470/2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report"},{"source":"nuclei","id":"CVE-2021-35587","title":"Oracle Access Manager - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35587.yaml"}],"products":[{"vendor":"oracle","product":"access_manager"},{"vendor":"oracle","product":"fusion middleware"},{"vendor":"oracle corporation","product":"access manager"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35587"},{"url":"https://github.com/advisories/GHSA-x3jv-936g-xqj4"}],"sources":{"cve":[{"id":"CVE-2021-35587","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2022-01-19T11:21:42Z","modified":"2025-10-21T23:15:48.829Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-22223","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2022-01-19T11:21:42Z","modified":"2025-10-21T23:15:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-11-28","updated_at":"2026-11-02T20:31:25.901288Z"}],"ghsa":[{"id":"GHSA-x3jv-936g-xqj4","title":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2022-01-20T00:01:49Z","modified":"2025-10-22T00:32:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2021-35587","title":"Oracle Fusion Middleware Unspecified Vulnerability","description":"Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.","cwes":["CWE-502","CWE-790"],"kev":{"date_added":"2022-11-28","due_date":"2022-12-19","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2021-35587","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2022-01-19T12:15:09.727Z","modified":"2026-06-17T03:57:46.353Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:07:03.821385Z"}]}}