Live › vulnerability › CVE-2021-35464
Go to dashboardForgeRock Access Management (AM) Core Server has an unauthenticated remote code execution flaw reachable through three /ccversion/ HTTP endpoints. An attacker who sends a crafted HTTP request runs code as the user the AM server runs under, and the CISA KEV catalog lists it as actively exploited with ransomware use noted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ForgeRock Access Management (AM) | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the vendor update per ForgeRock instructions; the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier
This page as .md · .json · in your agent: get_signal("CVE-2021-35464")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.