---
id: "CVE-2021-22502"
kind: "vulnerability"
aliases: ["CVE-2021-22502"]
title: "Micro Focus Operation Bridge Reporter (OBR): Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.9674
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Micro Focus Operation Bridge Reporter (OBR)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "micro-focus", "obr", "operation-bridge-reporter", "vendor"]
not_affected_if: ["not-running-obr"]
published_at: "2021-02-08T22:15:12+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22502", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-22502", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22502", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Micro Focus Operation Bridge Reporter (OBR): Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability

Micro Focus Operation Bridge Reporter (OBR) has an unspecified flaw that allows remote code execution. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Micro Focus Operation Bridge Reporter (OBR) affected ? fixed ?

## Fix

Apply the vendor's updates per Micro Focus instructions; CISA's KEV entry says only 'Apply updates per vendor instructions'.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22502
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-22502
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-22502

## From the sources

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_