{"id":"CVE-2021-35464","kind":"vulnerability","aliases":["CVE-2021-35464"],"related":[],"title":"ForgeRock Access Management (AM): ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability","description":"ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier","summary":"ForgeRock Access Management (AM) Core Server has an unauthenticated remote code execution flaw reachable through three /ccversion/ HTTP endpoints. An attacker who sends a crafted HTTP request runs code as the user the AM server runs under, and the CISA KEV catalog lists it as actively exploited with ransomware use noted.","severity":"critical","cvss":10.0,"epss":0.99999,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"ForgeRock Access Management (AM)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","forgerock-am","identity","ransomware","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the vendor update per ForgeRock instructions; the sources do not name the fixed version.","status":"open","published_at":"2021-07-22T18:15:23+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:21+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:41:21Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per ForgeRock instructions; the sources do not name the fixed version.\nunknown","reach":"internet","impact":"high","summary":"ForgeRock Access Management (AM) Core Server has an unauthenticated remote code execution flaw reachable through three /ccversion/ HTTP endpoints. An attacker who sends a crafted HTTP request runs code as the user the AM server runs under, and the CISA KEV catalog lists it as actively exploited with ransomware use noted.","category":"vendor","who_cares":["forgerock-am","self-hosted","identity"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote code runs as the AM server user, enabling full server takeover","analyst_note":"Find the fixed AM version and a check for the /ccversion/ endpoints in the vendor advisory; the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-35464 gives only the vendor-update instruction.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000512,"input_tokens":2925,"output_tokens":440,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the fixed AM version and a check for the /ccversion/ endpoints in the vendor advisory; the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-35464 gives only the vendor-update instruction.","search":"'-2021':16A,19A '-35464':17A,20A '/ccversion':51B,121C '7.0':90C '8':144C 'access':2A,6A,22A,36B 'activ':80B 'am':24A 'applic':136C 'attack':55B 'authent':108C 'catalog':76B 'cisa':74B 'code':12A,45B,63B,111C 'core':9A,39B 'craft':59B,120C 'cve':15A,18A 'deseri':94C 'due':129C 'earlier':146C 'endpoint':53B 'execut':13A,46B,112C 'exist':128C 'exploit':25B,81B,104C 'flaw':47B 'forgerock':1A,5A,21A,27B,35B,86C 'forgerock-am':26B 'found':139C 'framework':137C 'host':33B 'http':52B,60B 'ident':29B 'jato':138C 'jato.pagesession':98C 'java':93C,143C 'kev':75B 'list':77B 'manag':3A,7A,37B 'management':23A 'multipl':101C 'note':85B 'one':135C 'page':102C 'paramet':99C 'ransomwar':30B,83B 'reachabl':48B 'remot':11A,44B,110C 'request':61B,122C 'requir':107C 'run':62B,70B 'self':32B 'self-host':31B 'send':57B,117C 'server':10A,40B,69B,88C,125C 'singl':119C 'sun':134C 'three':50B 'trigger':115C 'unauthent':43B 'usag':132C 'use':84B 'user':66B 'vendor':34B 'version':141C 'vulner':14A,95C,127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-07-22T18:15:23+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-35464","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-35464","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2021-35464","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-35464","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-35464","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35464","severity":null,"published_at":"2021-07-22T18:15:23+00:00","modified_at":"2026-06-17T03:57:31+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}