{"basis":"claimed","id":"CVE-2021-35587","name":"Oracle Fusion Middleware Unspecified Vulnerability","vendorProject":"Oracle","product":"Fusion Middleware","publishedAt":"2022-01-19","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2022-11-28","dueDate":"2022-12-19","ransomware":false},"epss":{"score":0.96284,"percentile":0.99879,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"off","firstOn":"2025-04-22","daysToRule":1189},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"no_history","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2023-06-06","daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"no_history","firstOn":null,"daysToRule":null}},"title":null,"description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cwes":["CWE-502","CWE-790"],"vendors":[{"vendor":"cloudflare","status":"off","basis":"claimed","firstOn":"2025-04-22","firstIsNew":true,"daysToRule":1189,"daysAtMost":null,"freePlan":false,"claims":[{"id":"6ae3bd582ed14e0e0daf9049916d1e93eae4dcd8f7152c1d6c1b057524e0bd0e","cve_id":"CVE-2021-35587","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"410317f1e32b41859fa3214dd52139a8","rule_name":"Oracle Access Manager - Remote Code Execution - CVE:CVE-2021-35587","change":"new","default_action":"Disabled","published_on":"2025-04-22","source_url":"https://developers.cloudflare.com/changelog/post/2025-04-22-waf-release/","source_title":"WAF Release - 2025-04-22","excerpt":"Oracle Access Manager - Remote Code Execution - CVE:CVE-2021-35587. Previous action: Log. New action: Disabled. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.558Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2023-06-06","firstIsNew":false,"daysToRule":null,"daysAtMost":503,"freePlan":false,"claims":[{"id":"d6148bba609daac1cc4e82f5a5672719b91943b7f3f0714b2843b5816f5c9aeb","cve_id":"CVE-2021-35587","vendor":"f5","product":"Attack signatures","rule_id":"200104793","rule_name":"Oracle Access Manager requester RCE","change":"updated","default_action":null,"published_on":"2023-06-06","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Updated: signature 200104793 \"Oracle Access Manager requester RCE\" (Server Side Code Injection, risk High), systems: Microsoft Windows, Oracle. References: CVE-2021-35587.","first_seen_at":"2026-11-02T21:00:28.480Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-03T01:17:40.960Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2021-35587","templatePath":"http/cves/2021/CVE-2021-35587.yaml","requests":1,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/oam/server/opensso/sessionservice","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"passed","templateId":"CVE-2021-35587","templatePath":"http/cves/2021/CVE-2021-35587.yaml","requests":1,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/oam/server/opensso/sessionservice","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}