CVE-2021-35587: Oracle Fusion Middleware Unspecified Vulnerability

CVE-2021-35587 is an unspecified vulnerability in Oracle Fusion Middleware that affects the Access Manager component. According to CISA, it allows an unauthenticated attacker with network access via HTTP to take over the Access Manager product. This matters because Access Manager often sits at the front of identity and access control for enterprise applications; successful takeover can give an attacker broad control over authentication and authorization decisions.

Public detail on exact mechanics is limited. Defenders should treat this as a high-impact remote compromise risk for any exposed Access Manager instance and confirm all specifics against the Oracle vendor advisory.

How it works

The vulnerability is associated with CWE-502 (Deserialization of Untrusted Data) and CWE-790 (Improper Filtering of Special Elements). In this class of flaw, an application processes untrusted input—commonly over HTTP—without adequate validation or filtering. An attacker who can reach the service can supply crafted data that the Access Manager component mishandles, leading to unauthorized control of the product.

Because the attacker needs only network access via HTTP and no prior authentication, any internet-facing or poorly segmented Access Manager endpoint is a potential target. Exact exploit steps and payload formats are not provided in public summaries; treat any unauthenticated HTTP interaction with the component as potentially dangerous until the instance is patched and confirmed clean.

Am I affected? How to find it in your systems

Oracle Fusion Middleware, including Access Manager, is typically deployed in enterprise identity, single-sign-on, and access-control environments. It may run on application servers, often behind reverse proxies or load balancers, and is commonly used to protect internal and external web applications.

• Inventory all Oracle Fusion Middleware installations, paying special attention to Access Manager components. Check configuration management databases, software asset inventories, and package or installer records.
• Identify listening HTTP/HTTPS endpoints associated with Access Manager. Review network scans, load-balancer configurations, and firewall rules for hosts that expose these services.
• Confirm the exact product versions and patch levels against the Oracle advisory for CVE-2021-35587; do not rely on generic version lists.
• Look for anomalous unauthenticated HTTP traffic to Access Manager endpoints, unexpected process behavior, or new administrative sessions. Review application and web-server logs for unusual request patterns or errors that coincide with access attempts.

If you cannot determine whether a given installation is vulnerable, assume it is until you verify the installed version and applied patches with the vendor documentation.

How to remediate

The primary remediation is to apply the updates provided by Oracle for this vulnerability. CISA’s required action is to apply updates per vendor instructions. Obtain the official patches or Critical Patch Updates from Oracle, test them in a non-production environment if possible, and deploy them promptly to all affected Access Manager instances.

• After patching, restart services as directed by the vendor and verify that the Access Manager component is running the corrected code.
• Harden the deployment by restricting administrative interfaces, enforcing least-privilege accounts, and ensuring that only necessary network paths reach the Access Manager HTTP endpoints.
• Review and tighten input validation and deserialization configurations where the product allows such controls, consistent with Oracle guidance for this class of weakness.

Document the patch status and retain evidence of the update for audit and incident-response purposes.

If you can't patch immediately

If immediate patching is not feasible, apply compensating controls to reduce exposure while you prepare the update.

• Segment Access Manager hosts so that only trusted networks and systems can reach the HTTP interfaces. Block or tightly control internet-facing access.
• Place a web application firewall or reverse proxy in front of the service and apply virtual-patching rules that filter suspicious or malformed requests typical of deserialization and special-element abuse. Confirm rule effectiveness against the vendor advisory and your own traffic baselines.
• Disable or restrict any non-essential Access Manager features or endpoints that are not required for business operations.
• Increase monitoring: alert on unauthenticated access attempts, anomalous request volumes, unexpected configuration changes, and new privileged sessions. Retain logs long enough to support forensic review.

These measures lower risk but do not eliminate it; schedule the official Oracle update as soon as possible.

If your data may have been exposed

Actively exploited remote-takeover vulnerabilities can lead to full product compromise and subsequent data exposure or lateral movement. Known ransomware use of this CVE is not documented, but any successful takeover of Access Manager should be treated as a potential security incident. Investigate for unauthorized access, review authentication logs, and rotate credentials that may have been exposed. You can also run a free exposure scan of your email addresses against known breach data to check whether related accounts appear in public breach collections.