{"history":[{"alert":0,"cve":"CVE-2021-35587","id":22179,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.96284, \"percentile\": 0.9988}"},{"alert":0,"cve":"CVE-2021-35587","id":19798,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.96284, \"percentile\": 0.99879}"},{"alert":0,"cve":"CVE-2021-35587","id":17764,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.96284, \"percentile\": 0.99879}"},{"alert":0,"cve":"CVE-2021-35587","id":15828,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.96284, \"percentile\": 0.99879}"},{"alert":0,"cve":"CVE-2021-35587","id":13806,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.96284, \"percentile\": 0.99879}"},{"alert":0,"cve":"CVE-2021-35587","id":11588,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.96284, \"percentile\": 0.99879}"},{"alert":0,"cve":"CVE-2021-35587","id":9574,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.96284, \"percentile\": 0.99879}"},{"alert":1,"cve":"CVE-2021-35587","id":8418,"kind":"cna","observed_at":1793852400,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-04T00:40:47.369Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2021-35587\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2024-09-25T19:01:08.669891Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2022-11-28\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-306\", \"description\": \"CWE-306 Missing Authentication for Critical Function\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:15:48.829Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2022-11-28T00:00:00.000Z\", \"value\": \"CVE-2021-35587 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"Access Manager\", \"vendor\": \"Oracle Corporation\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.1.2.3.0\"}, {\"status\": \"affected\", \"version\": \"12.2.1.3.0\"}, {\"status\": \"affected\", \"version\": \"12.2.1.4.0\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager.\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2022-01-19T11:21:42.000Z\", \"orgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"shortName\": \"oracle\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"secalert_us@oracle.com\", \"ID\": \"CVE-2021-35587\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"Access Manager\", \"version\": {\"version_data\": [{\"version_affected\": \"=\", \"version_value\": \"11.1.2.3.0\"}, {\"version_affected\": \"=\", \"version_value\": \"12.2.1.3.0\"}, {\"version_affected\": \"=\", \"version_value\": \"12.2.1.4.0\"}]}}]}, \"vendor_name\": \"Oracle Corporation\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\"}]}, \"impact\": {\"cvss\": {\"baseScore\": \"9.8\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager.\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://www.oracle.com/security-alerts/cpujan2022.html\", \"refsource\": \"MISC\", \"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"assignerShortName\": \"oracle\", \"cveId\": \"CVE-2021-35587\", \"datePublished\": \"2022-01-19T11:21:42.000Z\", \"dateReserved\": \"2021-06-28T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:15:48.829Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2021-35587","id":7122,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.96284, \"percentile\": 0.99879}"},{"alert":0,"cve":"CVE-2021-35587","id":4899,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.96284, \"percentile\": 0.99879}"},{"alert":0,"cve":"CVE-2021-35587","id":2681,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.96284, \"percentile\": 0.99879}"},{"alert":1,"cve":"CVE-2021-35587","id":910,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2021-35587\", \"cwes\": [\"CWE-502\", \"CWE-790\"], \"dateAdded\": \"2022-11-28\", \"dueDate\": \"2022-12-19\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://www.oracle.com/security-alerts/cpujan2022.html; https://nvd.nist.gov/vuln/detail/CVE-2021-35587\", \"product\": \"Fusion Middleware\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.\", \"vendorProject\": \"Oracle\", \"vulnerabilityName\": \"Oracle Fusion Middleware Unspecified Vulnerability\"}"}],"record":{"affected":[{"product":"Access Manager","vendor":"Oracle Corporation","versions":[{"status":"affected","version":"11.1.2.3.0"},{"status":"affected","version":"12.2.1.3.0"},{"status":"affected","version":"12.2.1.4.0"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-04T00:40:47.369Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.oracle.com/security-alerts/cpujan2022.html"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2021-35587","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2024-09-25T19:01:08.669891Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2022-11-28","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-21T23:15:48.829Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587"}],"timeline":[{"lang":"en","time":"2022-11-28T00:00:00.000Z","value":"CVE-2021-35587 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Access Manager","vendor":"Oracle Corporation","versions":[{"status":"affected","version":"11.1.2.3.0"},{"status":"affected","version":"12.2.1.3.0"},{"status":"affected","version":"12.2.1.4.0"}]}],"descriptions":[{"lang":"en","value":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager.","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2022-01-19T11:21:42.000Z","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle"},"references":[{"tags":["x_refsource_MISC"],"url":"https://www.oracle.com/security-alerts/cpujan2022.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert_us@oracle.com","ID":"CVE-2021-35587","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Access Manager","version":{"version_data":[{"version_affected":"=","version_value":"11.1.2.3.0"},{"version_affected":"=","version_value":"12.2.1.3.0"},{"version_affected":"=","version_value":"12.2.1.4.0"}]}}]},"vendor_name":"Oracle Corporation"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},"impact":{"cvss":{"baseScore":"9.8","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager."}]}]},"references":{"reference_data":[{"name":"https://www.oracle.com/security-alerts/cpujan2022.html","refsource":"MISC","url":"https://www.oracle.com/security-alerts/cpujan2022.html"}]}}}},"cveMetadata":{"assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","assignerShortName":"oracle","cveId":"CVE-2021-35587","datePublished":"2022-01-19T11:21:42.000Z","dateReserved":"2021-06-28T00:00:00.000Z","dateUpdated":"2025-10-21T23:15:48.829Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794349204,"cve":"CVE-2021-35587","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","epss":{"date":"2026-11-12","epss":0.96284,"percentile":0.9988},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2021-35587","cwes":["CWE-502","CWE-790"],"dateAdded":"2022-11-28","dueDate":"2022-12-19","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://www.oracle.com/security-alerts/cpujan2022.html; https://nvd.nist.gov/vuln/detail/CVE-2021-35587","product":"Fusion Middleware","requiredAction":"Apply updates per vendor instructions.","shortDescription":"Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.","vendorProject":"Oracle","vulnerabilityName":"Oracle Fusion Middleware Unspecified Vulnerability"},"kev_checked":1794522003,"products":"Oracle Corporation Access Manager","references":["https://www.oracle.com/security-alerts/cpujan2022.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"oracle","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Oracle Fusion Middleware Unspecified Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}