Oracle Access Manager (OpenSSO Agent) Remote Code Execution and System Takeover Vulnerability (CVE-2021-35587) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTOracle Access Manager within Oracle Fusion Middleware, versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0
Unauthenticated remote attackers can gain full control of the Oracle Access Manager system and execute arbitrary code via HTTP network access
Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external access to OpenSSO Agent endpoints
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the latest security patches provided in the Oracle Critical Patch Update (CPU). Use the OPatch utility to apply the patch to your OAM environment.
# 1. Set Oracle environment variables
export ORACLE_HOME='/u01/app/oracle/middleware/oracle_common'
export PATH=$ORACLE_HOME/OPatch:$PATH
# 2. Verify current inventory and check for patch conflicts
opatch lsinventory
opatch prereq CheckConflictAgainstOHWithDetail -phBaseDir /path/to/downloaded/patch
# 3. Apply the downloaded Oracle Access Manager patch
cd /path/to/downloaded/patch
opatch apply2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict external access to the vulnerable OpenSSO and OAM registration endpoints using a reverse proxy or Web Application Firewall (WAF).
# Nginx configuration to block external access to vulnerable OAM endpoints
server {
listen 80;
server_name oam.company.internal;
# Block access to vulnerable endpoints
location ~* ^/oam/server/(oam_reg\.jsp|.*opensso.*) {
deny all;
return 403;
}
location / {
proxy_pass http://oam_backend_servers;
proxy_set_header Host $host;
}
}3. Log Audit & IoC Verification Commands
Search OAM access logs for unauthorized or suspicious requests targeting the vulnerable endpoints.
# Search OAM HTTP access logs for attempts to access vulnerable endpoints
LOG_DIR='/u01/app/oracle/config/domains/oam_domain/servers/oam_server1/logs'
grep -Ei '(oam_reg\.jsp|opensso)' $LOG_DIR/access.log* | grep -E 'POST|GET'
# Check server output logs for Java deserialization errors or suspicious execution patterns
grep -ri 'ObjectInputStream' $LOG_DIR/oam_server1.out* 2>/dev/nullBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the OpenSSO Agent component of Oracle Access Manager (OAM), a core identity and access management solution in Oracle Fusion Middleware. The root cause is the lack of proper authentication (CWE-306) on specific servlet endpoints, allowing unauthenticated network requests to trigger unsafe deserialization of untrusted data or access sensitive internal functions. This enables attackers to bypass authentication mechanisms entirely.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a specially crafted HTTP request containing a malicious payload to vulnerable OpenSSO Agent endpoints (such as '/oam/server/oam_reg.jsp' or related servlet paths) on the OAM server. Because the server processes these requests without validating the sender's identity or the integrity of the input, it deserializes the malicious payload. By leveraging common Java deserialization gadget chains, the attacker can execute arbitrary system commands under the privileges of the OAM process, leading to web shell deployment or backdoor installation.
3. Infrastructure & Business Impact
Oracle Access Manager serves as the central authentication and Single Sign-On (SSO) hub for enterprise environments. This vulnerability has been assigned a CVSS 3.1 base score of 9.8 (Critical) and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Compromise of the OAM infrastructure can lead to complete authentication bypass across the entire enterprise network, facilitating lateral movement, data exfiltration, and ransomware deployment.
Official Vendor Advisories & References
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Frequently Asked SecOps Questions (CVE-2021-35587)
FAQQ1. How critical is CVE-2021-35587 and is it actively exploited in the wild?
CVE-2021-35587 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 96.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-35587?
Primary impacted vendors include oracle across oracle_access_manager, fusion_middleware. Scope summary: Oracle Access Manager (component: OpenSSO Agent) in Oracle Fusion Middleware, versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0
Q3. What temporary mitigations or workarounds exist for CVE-2021-35587 before patching?
[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external access to OpenSSO Agent endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-35587
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (oracle)
View Category →Oracle PeopleSoft Enterprise PeopleTools Remote Code Execution and System Takeover Vulnerability (CVE-2026-35273)
[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62
Oracle E-Business Suite Payments File Transmission Authentication Bypass and Remote Code Execution (CVE-2026-46817)
[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component
Microsoft Office SharePoint Missing Authentication Privilege Escalation Vulnerability (CVE-2026-56164) Security Advisory
[Affected Scope] Microsoft Office SharePoint Server environments
Splunk Enterprise Unauthenticated Arbitrary File Creation and RCE via PostgreSQL Sidecar Service (CVE-2026-20253)
[Affected Scope] Splunk Enterprise versions 10.2.x below 10.2.4 and 10.0.x below 10.0.7 (versions 9.4 and earlier are unaffected)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.