Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-35464

CVE-2021-35464CRITICAL

n/a n/a — ForgeRock Access Management (AM)

  AV  AC  PR  UI  S  C  I  A   CVSS     EPSS    %ile   KEV
   N   L   N   N  U  H  H  H    9.8   1.0000   100.0   YES

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Jun 23  Reserved by mitre
  Jul 22  Published (CNA: mitre)
  Nov 3   Added to CISA KEV, remediation due 2021-11-17

CWE-502 · CNA: mitre · CVSS v3.1 · 5 references · KEV due November 17, 2021

Description

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 23, 2021	Reserved	Reserved by mitre
July 22, 2021	Published	Published (CNA: mitre)
November 3, 2021	KEV ADDED	Added to CISA KEV, remediation due 2021-11-17

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	n/a	—	n/a	—

Weaknesses

CWE-502

References (5)

http://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html [x_refsource_MISC]
http://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html [x_refsource_MISC]
https://backstage.forgerock.com/knowledge/kb/article/a47894244 [x_refsource_CONFIRM]
https://bugster.forgerock.org [x_refsource_MISC]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35464 [government-resource]

Authoritative record: CVE-2021-35464 at cve.org

Weaknesses: CWE-502

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-35464 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.