{"schemaVersion":3,"id":"CVE-2021-35587","aliases":[],"status":"published","duplicateOf":null,"title":"Oracle Fusion Middleware Unspecified Vulnerability","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","dates":{"published":"2022-01-19T11:21:42.000Z","modified":"2025-10-21T23:15:48.829Z","reserved":null,"kevAdded":["2022-11-28T00:00:00.000Z"],"kevDue":["2022-12-19T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.96284,"percentile":0.99881,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.96284},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.96284,"percentile":0.99881}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.96284,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.96284,"percentile":0.99881}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-11-28T00:00:00.000Z","dueDate":"2022-12-19T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Oracle Fusion Middleware Unspecified Vulnerability","description":"Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.","notes":[{"type":"url","href":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"www.oracle.com/security-alerts/cpujan2022.html"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-35587","label":"nvd.nist.gov/vuln/detail/CVE-2021-35587"}],"vendor":"Oracle","product":"Fusion Middleware","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-11-28T00:00:00.000Z","dueDate":"2022-12-19T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Oracle Fusion Middleware Unspecified Vulnerability","description":"Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.","notes":[{"type":"url","href":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"www.oracle.com/security-alerts/cpujan2022.html"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-35587","label":"nvd.nist.gov/vuln/detail/CVE-2021-35587"}],"vendor":"Oracle","product":"Fusion Middleware","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"MSF_EXPLOIT_MULTI_HTTP_ORACLE_ACCESS_MANAGER_RCE_CVE_2021_35587","name":"Oracle Access Manager unauthenticated Remote Code Execution","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/multi/http/oracle_access_manager_rce_cve_2021_35587.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/multi/http/oracle_access_manager_rce_cve_2021_35587","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["crash-safe"],"sideEffects":["ioc-in-logs"],"reliability":["repeatable-session"]}}],"exploitCount":1,"weaknesses":[{"id":"CWE-306","name":"Missing Authentication for Critical Function","description":"The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/306.html"}],"affected":[{"vendor":"oracle corporation","product":"access manager","name":"Access Manager","label":"access manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"11.1.2.3.0","noFixRecorded":false,"fixedIn":null},{"text":"12.2.1.3.0","noFixRecorded":false,"fixedIn":null},{"text":"12.2.1.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.1.2.3.0 | 12.2.1.3.0 | 12.2.1.4.0","eol":null,"hubHref":"/vendor/oracle_corporation/access_manager"},{"vendor":"oracle","product":"access_manager","name":"access manager","label":"access_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"11.1.2.3.0","noFixRecorded":false,"fixedIn":null},{"text":"12.2.1.3.0","noFixRecorded":false,"fixedIn":null},{"text":"12.2.1.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.1.2.3.0 | 12.2.1.3.0 | 12.2.1.4.0","eol":null,"hubHref":"/vendor/oracle/access_manager"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"www.oracle.com/security-alerts/cpujan2022.html","hostname":"www.oracle.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-01-19T11:21:42.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-11-28T00:00:00.000Z","label":"Added to CISA KEV","detail":"Oracle Fusion Middleware Unspecified Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-12-19T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:15:48.829Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T05:01:41.529Z","stale":false,"partial":false}}