CVE-2021-35587: Oracle Access Manager unauthenticated takeover, actively exploited
The short version: CVE-2021-35587 is an unauthenticated flaw in Oracle Access Manager (OAM), the component that brokers single sign-on for Oracle Fusion Middleware. Reaching a specific endpoint without credentials lets an attacker compromise OAM — up to creating privileged users and executing code. It's exploited in the wild and in CISA's KEV catalog. Compromising the authentication gatekeeper is as high-leverage as it gets. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 96.3% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-12-19 |
| Known exploited? | Yes — active in-the-wild exploitation; public proof-of-concept since 2022 |
| Vulnerability type | CWE-306 missing authentication for a critical function → unauthenticated takeover / RCE |
| Requires authenticated session? | No — pre-authentication |
| Affected | Oracle Access Manager 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0 (OpenSSO Agent) |
| Fixed in | Oracle Critical Patch Update, January 2022 |
What you need to know
Oracle Access Manager is the SSO/authentication broker in front of Oracle Fusion Middleware applications — the thing that decides who gets in. CVE-2021-35587 is a missing-authentication flaw in its OpenSSO Agent component: crafted requests to the /oam/server/opensso/sessionservice endpoint let an unauthenticated attacker subvert the OAM environment.
Why compromising this particular product is so serious:
- It's the gatekeeper. Taking over OAM can mean forging or bypassing authentication for everything it protects — including creating a superuser or reaching code execution.
- It's unauthenticated and low-complexity. Network access over HTTP is enough; a proof-of-concept has been public since 2022.
- It's confirmed exploited. CISA added it to the KEV catalog on evidence of active exploitation, alongside its high EPSS.
How serious we see it
High — the 9.8 matches reality.
Unauthenticated compromise of the single sign-on authority is a worst-case target: the attacker doesn't just get one application, they get the mechanism that vouches for identity across many. Confirmed in-the-wild exploitation and a KEV listing seal it. Paper and practice agree.
The bounded, reassuring part: it affects specific OAM versions via a specific endpoint, Oracle's fix is published, and exposure is quick to confirm. The catch is trust — if OAM was compromised, assume issued sessions and downstream trust are suspect until you've reviewed them.
Recommendations
Straight from Oracle's January 2022 CPU and CISA:
- Patch now. Apply the January 2022 Critical Patch Update to affected OAM 11.1.2.3.0 / 12.2.1.3.0 / 12.2.1.4.0.
- Restrict the endpoint. Until patched, limit access to
/oam/server/opensso/sessionserviceand keep OAM off the open internet where possible. - Hunt. Review logs for requests to that endpoint and for unexpected OAM administrative accounts or configuration changes.
- If you find indicators, respond fully. Rotate credentials and secrets, invalidate sessions, and review downstream applications that trust OAM.
- Confirm your exposure first. Verify whether you run an affected OAM version and whether it's internet-reachable.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing Oracle Access Manager interfaces, fingerprints the product and version, and flags exposure tied to this KEV-listed, actively exploited flaw so it rises to the top of your results. Where verification is enabled, it goes a safe step beyond a scanner: it sends a single benign request to the affected endpoint and checks the response headers and body for the tell-tale signs of the flaw — confirming the exposure holds, as a benign check rather than a takeover.
That outside-in, continuous view is the point: an exposed, affected OAM is already mapped, so you go straight to patch-and-verify.