Cyber Resilience

CVE-2021-35464

CriticalCISA KEVActive ExploitationEUVD ExploitedPublic PoCRansomware-linkedRCE

Published: 22 July 2021

Published
22 July 2021
Modified
05 November 2025
KEV Added
03 November 2021
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9439 100.0th percentile
Risk Priority 96 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-35464 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Forgerock Access Management. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

ForgeRock AM server versions prior to 7.0 contain a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The flaw arises from the use of the Sun ONE Application Framework (JATO) present in Java 8 and earlier releases, and it is tracked as CVE-2021-35464 with a CVSS v3.1 score of 9.8 under CWE-502.

Unauthenticated remote attackers can trigger the issue by sending a single crafted request to the /ccversion/* endpoint, resulting in remote code execution on the server.

Public exploit code for the vulnerability has been posted to PacketStorm Security, and ForgeRock has published related knowledge base articles and references for affected deployments.

EU & UK References

Vulnerability details

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server.…

more

The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier

CWE(s)
CWE-502
KEV Date Added
03 November 2021

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

forgerock
access management
≤ 6.5.4
forgerock
openam
9.0.0 — 14.6.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly blocks the crafted jato.pageSession deserialization payload before it reaches the JATO framework.

SI-2 Flaw Remediation good match
prevent

Requires prompt patching or upgrade of ForgeRock AM to version 7.0+ that removes the vulnerable JATO deserialization path.

AC-3 Access Enforcement partial match
prevent

Enforces authentication and access restrictions on the /ccversion/* endpoints so unauthenticated requests cannot reach the vulnerable parameter.

References