Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .9628 99.9 YES
AFFECTED Product Versions Fixed Access Manager 11.1.2.3.0 – —
TIMELINE Jun 28 Reserved by oracle Jan 19 Published (CNA: oracle) Nov 28 Added to CISA KEV, remediation due 2022-12-19
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
| Date | Event | Detail |
|---|---|---|
| June 28, 2021 | Reserved | Reserved by oracle |
| January 19, 2022 | Published | Published (CNA: oracle) |
| November 28, 2022 | KEV ADDED | Added to CISA KEV, remediation due 2022-12-19 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Oracle Corporation | Access Manager | — | 11.1.2.3.0 | — |
Authoritative record: CVE-2021-35587 at cve.org
Vendors: oracle
Weaknesses: CWE-306
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-35587 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
