CVE-2021-35587

What it actually does

CVE-2021-35587 is a critical unauthenticated network-exploitable vulnerability in the OpenSSO Agent component of Oracle Access Manager in Oracle Fusion Middleware. An attacker with HTTP access to an affected Oracle Access Manager deployment can compromise the product without credentials or user interaction. Successful exploitation can result in full confidentiality, integrity, and availability impact, including authentication bypass, administrative takeover, modification of access-control behavior, exposure of identity/session data, and disruption of access management services.

Why it matters to the business

Oracle Access Manager commonly protects access to business applications, identity workflows, and administrative portals. Compromise can allow attackers to bypass authentication controls, impersonate users, alter access policies, disrupt single sign-on, and potentially pivot into applications that rely on Oracle Access Manager for trust decisions. The vulnerability is listed in CISA KEV with a remediation deadline of 2022-12-19, has a very high EPSS score of 0.96284, and is known to be actively exploited in the wild, so unpatched internet-accessible or partner-accessible deployments should be treated as high-priority exposure.

How an attack unfolds

An attacker first identifies an Oracle Access Manager instance reachable over HTTP or HTTPS. They then send crafted unauthenticated requests to vulnerable OpenSSO Agent functionality. Because the flaw is low-complexity and requires no credentials, the attacker does not need an existing account or user interaction. If the target is vulnerable, the request can compromise Oracle Access Manager itself, giving the attacker control over authentication and access-management behavior. From that position, the attacker may create or alter sessions, change configuration or policies, access protected resources, harvest identity data, disrupt authentication services, and use the compromised identity tier as a foothold for broader application compromise.

How to fix it

Apply the Oracle Critical Patch Update or later Oracle-provided security patches that remediate CVE-2021-35587 for Oracle Access Manager / Oracle Fusion Middleware. Affected supported versions include 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0. If exact fixed package levels are not already standardized internally, upgrade to the latest supported Oracle Access Manager release and latest quarterly Oracle CPU for the installed release train. Prioritize systems exposed to the internet, partner networks, VPN users, or untrusted internal networks. If immediate patching is not possible, restrict HTTP/HTTPS access to Oracle Access Manager to trusted networks only, place it behind tightly controlled reverse proxies or WAF rules, disable unnecessary OpenSSO Agent exposure where feasible, enforce administrative network segmentation, and increase logging until patched. Mitigations should be treated as temporary because the vulnerability is actively exploited and unauthenticated.

How to confirm the fix worked

Confirm the deployed Oracle Access Manager version and patch inventory using Oracle OPatch, Oracle Universal Installer inventory, WebLogic/Fusion Middleware version records, and administrative console evidence. Verify that affected versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0 have the relevant Oracle CPU or later security fixes applied. Review exposed HTTP routes through load balancers, reverse proxies, and firewalls to ensure Oracle Access Manager is not reachable from untrusted networks except where explicitly required. Run an authenticated configuration and patch compliance check rather than relying only on banner versions, because middleware banners may be hidden or stale. After patching, restart required Oracle Fusion Middleware services, validate SSO and policy enforcement workflows, and confirm no vulnerable nodes remain behind load balancers or in disaster-recovery environments.

Typical attack path

1. Discover an exposed Oracle Access Manager or Oracle Fusion Middleware endpoint over HTTP or HTTPS.
2. Fingerprint the deployment version or behavior to determine whether Oracle Access Manager 11.1.2.3.0, 12.2.1.3.0, or 12.2.1.4.0 may be in use.
3. Send crafted unauthenticated HTTP requests targeting vulnerable OpenSSO Agent functionality.
4. Gain unauthorized control over Oracle Access Manager if the instance is vulnerable.
5. Modify access-management behavior, sessions, policies, or administrative state.
6. Use the compromised identity layer to access protected applications, impersonate users, or pivot further into the environment.
7. Cover tracks by deleting logs, altering audit configuration, or blending activity into normal authentication traffic.

How to detect it

To determine whether exploitation already occurred, review Oracle Access Manager, Oracle HTTP Server, WebLogic Server, reverse proxy, load balancer, WAF, endpoint, and network telemetry covering the period before patching and any period of external exposure. Focus on unauthenticated HTTP requests to Oracle Access Manager and OpenSSO-related paths, unusual request bursts, malformed parameters, unexpected HTTP 500 responses followed by successful authentication activity, and requests from unfamiliar IP addresses. Examine OAM audit and diagnostic logs for unauthorized administrative actions, new or modified authentication schemes, authorization policies, agents, session settings, identity stores, or configuration changes. On hosts, look for unexpected child processes launched by Java, WebLogic, or Oracle middleware service accounts, newly written web-accessible files, modified middleware configuration files, suspicious archive files, and outbound connections to unfamiliar infrastructure. Correlate suspected exploit traffic with subsequent account impersonation, privileged application access, unusual SSO sessions, or changes in protected-resource access patterns. Known public, stable payload indicators are not consistently documented for this CVE, so detection should combine endpoint/process anomalies, OAM configuration integrity checks, and HTTP telemetry rather than relying only on a single signature.

• /oam/
• OpenSSO
• opensso
• oracle.security.am
• oam_server
• oam_server1
• oam_server1-diagnostic.log
• AdminServer-diagnostic.log
• access_log
• java.lang.ProcessBuilder
• Runtime.getRuntime
• /tmp/
• cmd.exe
• powershell.exe
• /bin/sh
• /bin/bash

What your security team should do

• Immediately inventory all Oracle Access Manager and Oracle Fusion Middleware deployments, including standby, disaster-recovery, development, and externally proxied systems.
• Patch or upgrade affected Oracle Access Manager versions as an emergency priority, especially any deployment reachable over the internet or by untrusted users.
• Because this CVE is in CISA KEV and actively exploited, perform compromise assessment on exposed systems even if patching is completed successfully.
• Restrict network access to Oracle Access Manager administrative and runtime endpoints to the minimum required trusted sources.
• Review Oracle Access Manager administrative users, access policies, authentication schemes, agents, key material, and session configuration for unauthorized changes.
• Collect and preserve Oracle HTTP Server, WebLogic, Oracle Access Manager diagnostic, audit, and access logs before log rotation overwrites evidence.
• Hunt for suspicious unauthenticated requests, anomalous administrator activity, new or modified agents, abnormal session creation, and unexpected child processes spawned by middleware services.
• Monitor for lateral movement from Oracle Access Manager hosts, including unusual outbound connections, credential use, and access to protected applications shortly after suspicious OAM activity.
• If compromise is suspected, rotate relevant credentials, secrets, certificates, agent keys, and integration tokens that may have been accessible to Oracle Access Manager.