Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2022-01-19

CVE-2021-35587

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

  1. First PoC
  2. same day →Metasploit
  3. 178 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2022-11-28 · due 2022-12-19. An observation, not a forecast.
EPSS · 30-day forecast
96%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

2 known · links only

Metasploit1

  1. Oracle Access Manager unauthenticated Remote Code Execution ↗

    This module exploits an unauthenticated deserialization of untrusted data vulnerability in the OpenSSO Agent component of the Oracle Access Manager (OAM) product. The affected product versions are 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0.

    ruby · seen 2026-10-18

Nuclei1

  1. Oracle Access Manager - Remote Code Execution ↗

    The Oracle Access Manager portion of Oracle Fusion Middleware (component: OpenSSO Agent) is vulnerable to remote code execution. Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle Access Manager.

    yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.