WaratekVRT Sign in

CVE-2021-35587 Oracle Access Manager

Affected softwareOracle Access Manager
Affected versions11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0
Severity9.8 Critical CVSS 3.1 2 scores
Fixed inOracle Critical Patch Update January 2022
WeaknessMissing authentication (CWE-306)
Published19 Jan 2022
Updated13 Nov 2026

Description

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-11-28 · remediation due 2022-12-19 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 6 citations · honeypot sightings · 1 exploit · earliest 2022-11-28.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 4 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2022-03-14.
  • EPSS 96% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-35587 in VulnCheck (free account), which lists 1 more citation not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 699 days 2023-12-01 to 2026-11-11
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-11-28
Reported exploitation foresiet.com /blog/oracle-cloud-breach-hacker-claims-6m-records-and-140k-tenants-at-risk-foresiet-research-vs-oracles-denial 2025-03-25
Reported exploitation foresiet.com /blog/oracle-cloud-breach-oam-exploit-and-t3-protocol-clarified 2025-04-04
Reported exploitation hubspot.wallarm.com /hubfs/Wallarm%20Q1%202025%20API%20ThreatStats%20Report.pdf 2025-04-24
Reported exploitation blog.eclecticiq.com /shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications 2025-09-17
Exploit reference VulnCheck XDB ef01893d92f5 Exploit type: infoleak 2023-12-21

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Oracle Access Manager Unauthenticated Attacker Vulnerability CVE-2021-35587 42 2022-03-14
GitHub PoC Post-incident report analyzing the Oracle Cloud SSO/LDAP supply chain attack (CVE-2021-35587). Details the exploitation of legacy server infrastructure, impact across 140,000+ cloud tenants, root-cause findings, and phased mitigation strategies. 2026-08-28
Nuclei Oracle Access Manager - Remote Code Execution
Metasploit Oracle Access Manager unauthenticated Remote Code Execution (excellent rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Marshal RCE rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Marshal RCE rule

How to mitigate CVE-2021-35587

Apply the fix in Oracle Critical Patch Update January 2022. Until you can, Waratek RASP blocks exploitation with its deserialization rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H secalert_us@oracle.com Secondary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2022 ↗ CPU 2022-Q1 Oracle Fusion Middleware / OpenSSO Agent (11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware OpenSSO Agent 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0 11.1.2.3.0 · 12.2.1.3.0 · 12.2.1.4.0

Products and versions

1 product, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle access manager generic 11.1.2.3.0 · 12.2.1.3.0 · 12.2.1.4.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, OPENSSO AGENT, NO AUTH REMOTE EXPLOIT **Products:** ORACLE ACCESS MANAGER, ORACLE FUSION MIDDLEWARE

References

URLTags
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587 US Government Resource

Timeline
Published2022-01-19By the CVE Program.
Added to CISA KEV2022-11-28Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2022-11-28Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-11Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.