CVE-2021-35587
Oracle Fusion Middleware Unspecified Vulnerability
Description
CVE-2021-35587 is a critical vulnerability in Oracle Access Manager, a component of Oracle Fusion Middleware, that allows an unauthenticated attacker to completely take over the affected system. This missing authentication vulnerability affects the OpenSSO Agent component in Oracle Access Manager versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0, enabling remote exploitation over HTTP without any privileges or user interaction. With a CVSS score of 9.8 (Critical) and an EPSS score of 94.3%, CVE-2021-35587 represents one of the most actively exploited Oracle vulnerabilities. CISA has confirmed active exploitation in the wild and added this vulnerability to its Known Exploited Vulnerabilities catalog, making immediate patching essential for all organizations using Oracle Access Manager.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | access manager | 11.1.2.3.0; 12.2.1.3.0; 12.2.1.4.0 |
References
- https://www.oracle.com/security-alerts/cpujan2022.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
Oracle Access Manager fails to enforce proper authentication on critical functions within the OpenSSO Agent component, allowing unauthenticated attackers to access and take over the system. This missing authentication weakness is particularly severe in an access management product, as the compromised system is itself responsible for controlling authentication and authorization across the enterprise.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2021-35587 is remotely exploitable without physical access over HTTP, requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any attacker with network access to the Oracle Access Manager instance. Confidentiality (High): Successful exploitation results in complete takeover of Oracle Access Manager, exposing all authentication data, session tokens, user credentials, and access control policies managed by the system. Integrity (High): An attacker can modify access control configurations, create unauthorized accounts, and alter authentication flows to grant persistent access to protected applications. Availability (High): The attacker can disrupt authentication services for all applications relying on Oracle Access Manager, causing widespread service outages. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation activity, and the CVSS score of 9.8 (Critical) reflects the maximum possible impact across all security dimensions.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-35587 in the wild and has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of December 19, 2022. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation activity, placing this vulnerability among the most actively targeted flaws tracked by CISA. The easily exploitable nature of this vulnerability, combined with the high value of access management systems as targets, makes it a prime candidate for both opportunistic and targeted attacks.
Remediation
- Apply the Oracle Critical Patch Update (CPU) for January 2022 immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." The patch is documented in the Oracle Security Alert for January 2022.
- Upgrade Oracle Access Manager from the affected versions (11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0) by applying the specific patches referenced in the Oracle CPU advisory. Verify patch application through Oracle's OPatch utility.
- Restrict network access to Oracle Access Manager administration interfaces and the OpenSSO Agent endpoints. Place Oracle Access Manager behind a reverse proxy or web application firewall and limit HTTP access to only trusted networks and authorized administrators.
- Audit Oracle Access Manager logs for indicators of compromise, including unauthorized access attempts, unexpected configuration changes, new administrative accounts, and unusual authentication patterns. Given the critical nature of access management systems, check for signs of lateral movement using compromised credentials.
- Implement defense-in-depth measures including network segmentation to isolate Oracle Fusion Middleware components, enforce multi-factor authentication for administrative access, and deploy intrusion detection systems to monitor for exploitation attempts targeting the OpenSSO Agent.
Technical Details
CVE-2021-35587 is a missing authentication for critical function (CWE-306) vulnerability in the OpenSSO Agent component of Oracle Access Manager, part of Oracle Fusion Middleware. The vulnerability exists in versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0, and allows unauthenticated attackers to send specially crafted HTTP requests to the OpenSSO Agent endpoint to achieve complete system takeover. As reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack requires only network access via HTTP with low complexity and no prerequisites, resulting in full compromise of confidentiality, integrity, and availability. The flaw arises from inadequate authentication checks on sensitive administrative or configuration endpoints within the OpenSSO Agent, which is designed to integrate Oracle Access Manager with web servers and application servers. Successful exploitation grants the attacker complete control over the Oracle Access Manager instance, effectively compromising the authentication infrastructure for all downstream applications.
Frequently Asked Questions
Is CVE-2021-35587 being actively exploited?
Yes, CVE-2021-35587 is actively exploited in the wild. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of December 19, 2022. The EPSS score of 94.3% places it in the 99.9th percentile, indicating near-certain exploitation activity.
What products are affected by CVE-2021-35587?
CVE-2021-35587 affects Oracle Access Manager (a component of Oracle Fusion Middleware) versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0. Specifically, the vulnerability exists in the OpenSSO Agent component used for web server and application server integration.
How do I fix CVE-2021-35587?
Apply the Oracle Critical Patch Update (CPU) for January 2022, which includes the fix for this vulnerability. Restrict network access to Oracle Access Manager and the OpenSSO Agent endpoints, and audit logs for signs of compromise. See the Remediation section for detailed steps.
How severe is CVE-2021-35587?
CVE-2021-35587 is rated Critical with a CVSS score of 9.8 out of 10. Its EPSS score of 94.3% places it in the 99.9th percentile, indicating near-certain exploitation. The vulnerability allows complete system takeover, making it one of the most severe Oracle Fusion Middleware flaws.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.