vulnerability

Oracle OAM: CVE-2021-35587: Missing Authentication for Critical Function

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Published

Jan 19, 2022

Added

Mar 28, 2025

Modified

May 29, 2025

Description

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager.

Solution

oracle-oam-cve-2021-35587

References

CVE-2021-35587
https://attackerkb.com/topics/CVE-2021-35587
https://www.oracle.com/security-alerts/cpujan2022.html

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report