---
id: "CVE-2021-22506"
kind: "vulnerability"
aliases: ["CVE-2021-22506"]
title: "Micro Focus Micro Focus Access Manager: Micro Focus Access Manager Information Leakage Vulnerability"
severity: "high"
cvss: 7.5
epss: 0.25695
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Micro Focus Micro Focus Access Manager", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["access-manager", "exploited", "micro-focus", "saml", "vendor"]
not_affected_if: ["no-saml-configuration"]
published_at: "2021-03-26T14:15:11+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22506", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-22506", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22506", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Micro Focus Micro Focus Access Manager: Micro Focus Access Manager Information Leakage Vulnerability

Micro Focus Access Manager has an information leakage flaw in its SAML handling: a service provider redirection issue when the Assertion Consumer Service URL is used. An attacker can get data the product should keep private, such as session or assertion details, though the sources do not say exactly what leaks.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Micro Focus Micro Focus Access Manager affected ? fixed ?

## Fix

Apply the vendor update per Micro Focus instructions; the sources do not name a fixed version.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22506
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-22506
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-22506

## From the sources

Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_