CVE-2021-35587: Oracle Access Manager Auth Bypass Flaw

CVE-2021-35587 Overview

CVE-2021-35587 is a critical authentication bypass vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware, specifically affecting the OpenSSO Agent component. This vulnerability allows an unauthenticated attacker with network access via HTTP to completely compromise Oracle Access Manager, resulting in full system takeover. The flaw requires no privileges or user interaction to exploit, making it particularly dangerous in enterprise environments.

Critical Impact

This vulnerability enables complete takeover of Oracle Access Manager through unauthenticated network access. It is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate remediation.

Affected Products

• Oracle Access Manager version 11.1.2.3.0
• Oracle Access Manager version 12.2.1.3.0
• Oracle Access Manager version 12.2.1.4.0

Discovery Timeline

• January 19, 2022 - CVE-2021-35587 published to NVD
• October 27, 2025 - Last updated in NVD database

Technical Details for CVE-2021-35587

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), indicating that the OpenSSO Agent component fails to properly enforce authentication for sensitive operations. The flaw allows attackers to bypass authentication mechanisms entirely, gaining unauthorized access to the Oracle Access Manager system without valid credentials.

The vulnerability is easily exploitable due to the lack of authentication requirements and the ability to reach the vulnerable component over standard HTTP connections. Successful exploitation results in complete compromise of the Oracle Access Manager instance, affecting confidentiality, integrity, and availability of the system.

Oracle Access Manager serves as a critical identity and access management solution in enterprise environments, handling single sign-on, authentication, and authorization services. Compromise of this system can provide attackers with broad access to protected resources and the ability to manipulate authentication policies across the enterprise.

Root Cause

The root cause is missing authentication for critical functionality (CWE-306) within the OpenSSO Agent component. The affected endpoint or function does not properly validate that incoming requests originate from authenticated and authorized users before performing sensitive operations. This design flaw allows unauthenticated attackers to directly interact with and manipulate the Access Manager system.

Attack Vector

The attack vector is network-based, requiring only HTTP access to the vulnerable Oracle Access Manager instance. An attacker can exploit this vulnerability remotely without any prior authentication, privileges, or user interaction. The attack complexity is low, meaning no special conditions or circumstances need to exist for exploitation to succeed.

Attackers targeting this vulnerability typically:

1. Identify internet-exposed or internally accessible Oracle Access Manager instances
2. Send specially crafted HTTP requests to the vulnerable OpenSSO Agent component
3. Bypass authentication to gain unauthorized access to the system
4. Achieve full takeover of the Oracle Access Manager instance

Detection Methods for CVE-2021-35587

Indicators of Compromise

• Unusual HTTP traffic patterns targeting Oracle Access Manager endpoints, particularly the OpenSSO Agent
• Unauthorized configuration changes or new administrator accounts in Oracle Access Manager
• Authentication logs showing access without corresponding valid credential verification
• Unexpected outbound connections from Oracle Access Manager servers

Detection Strategies

• Monitor web application firewall (WAF) logs for suspicious requests targeting Oracle Access Manager URLs
• Implement network intrusion detection rules to identify exploitation attempts against the OpenSSO Agent
• Review Oracle Access Manager audit logs for unauthorized administrative actions or configuration modifications
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activity on Access Manager hosts

Monitoring Recommendations

• Enable comprehensive logging on Oracle Access Manager and forward logs to a centralized SIEM
• Configure alerts for authentication anomalies and unauthorized access attempts
• Establish baseline behavior for Oracle Access Manager network traffic to detect deviations
• Regularly audit user accounts and access policies for unauthorized changes

How to Mitigate CVE-2021-35587

Immediate Actions Required

• Apply the security patch from the Oracle Critical Patch Update January 2022 immediately
• Inventory all Oracle Access Manager deployments and verify they are running patched versions
• Restrict network access to Oracle Access Manager instances using firewalls and access control lists
• Review system logs for evidence of prior exploitation attempts

Patch Information

Oracle addressed this vulnerability in the January 2022 Critical Patch Update. Organizations should download and apply the appropriate patches from the Oracle Critical Patch Update January 2022 security advisory. Due to the critical severity and confirmed active exploitation, this patch should be prioritized for immediate deployment.

Affected versions requiring patching:

• Oracle Access Manager 11.1.2.3.0
• Oracle Access Manager 12.2.1.3.0
• Oracle Access Manager 12.2.1.4.0

Workarounds

• Implement network segmentation to limit access to Oracle Access Manager from untrusted networks
• Deploy a web application firewall (WAF) with rules to block known exploitation patterns
• Enable strict access controls to allow connections only from authorized administrative IP ranges
• Monitor for exploitation attempts while planning patch deployment

# Example: Restrict access to Oracle Access Manager using iptables
# Allow only trusted administrative networks
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP