# CVE-2021-35587: Oracle Fusion Middleware Unspecified Vulnerability

- Exploited (CISA KEV): yes, added 2022-11-28
- Published: 2022-01-19
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 96.3% (100th percentile)
- CWE: CWE-502, CWE-790

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Rule off by default | 2025-04-22 | 1189 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2023-06-06 | — |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

### Cloudflare

- 2025-04-22 · new · rule 410317f1e32b41859fa3214dd52139a8 · default Disabled
  > Oracle Access Manager - Remote Code Execution - CVE:CVE-2021-35587. Previous action: Log. New action: Disabled. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-04-22-waf-release/

### F5

- 2023-06-06 · updated · rule 200104793
  > Updated: signature 200104793 "Oracle Access Manager requester RCE" (Server Side Code Injection, risk High), systems: Microsoft Windows, Oracle. References: CVE-2021-35587.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 1 requests blocked), template CVE-2021-35587, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: passed (0 of 1 requests blocked), template CVE-2021-35587, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2021-35587 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2021-35587