Exploited vulnerability · CISA KEV

Is CVE-2021-35587 exploited? Yes: in CISA KEV since 28 Nov 2022

Gociux · Oracle Fusion Middleware · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2021-35587, Oracle Fusion Middleware Unspecified Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 28 Nov 2022, 313 days after it was published. It affects Oracle Fusion Middleware. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.

What to do

1. Check whether you run it. Look for Fusion Middleware in your asset inventory, including appliances and cloud images. Stack check lists every exploited Oracle CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 19 Jan 2022.
4. Get told next time. Email alerts when CISA adds a CVE for Oracle.

Other exploited CVEs in Fusion Middleware

• CVE-2025-61757: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability (21 Nov 2025)
• CVE-2020-2551: Oracle Fusion Middleware Unspecified Vulnerability (16 Nov 2023)
• CVE-2012-1710: Oracle Fusion Middleware Unspecified Vulnerability (25 May 2022)
• CVE-2012-0518: Oracle Fusion Middleware Unspecified Vulnerability (28 Mar 2022)
• CVE-2012-3152: Oracle Fusion Middleware Unspecified Vulnerability (3 Nov 2021)

References

• www.oracle.com/security-alerts/cpujan2022.html
• nvd.nist.gov/vuln/detail/CVE-2021-35587

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in November 2022 · Oracle scorecard · act-now radar.