CVE-2021-35587 is a critical vulnerability in Oracle Access Manager (versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0) within Oracle Fusion Middleware. This easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to fully compromise the affected Oracle Access Manager instance, leading to complete loss of confidentiality, integrity, and availability. With a CVSS score of 9.8 (Critical), it poses a severe risk, enabling system takeover and potential theft of single sign-on credentials. The vulnerability is actively exploited in the wild, listed in CISA's KEV catalog, and has publicly available exploit modules in Metasploit and Nuclei templates, indicating widespread attention and a high likelihood of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
11.1.2.3.0CPE matchmatch criteria | cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:* | ||
12.2.1.3.0CPE matchmatch criteria | cpe:2.3:a:oracle:access_manager:12.2.1.3.0:*:*:*:*:*:*:* | ||
12.2.1.4.0CPE matchmatch criteria | cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.