References https://nvd.nist.gov/vuln/detail/cve-2021-35587 https://www.cloudsek.com/blog/the-biggest-supply-chain-hack-of-2025-6m-records-for-sale-exfiltrated-from-oracle-cloud-affecting-over-140k-tenants https://www.sentinelone.com/vulnerability-database/cve-2021-35587/ https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316 https://www.acunetix.com/vulnerabilities/web/oracle-access-manager-opensso-deserialization-rce-cve-2021-35587/ https://www.rapid7.com/db/vulnerabilities/oracle-oam-cve-2021-35587/ https://www.rapid7.com/db/modules/exploit/multi/http/oracle_access_manager_rce_cve_2021_35587/ https://www.oracle.com/security-alerts/cpujan2022verbose.html https://censys.com/blog/critical-vulnerability-cve-2021-35587-in-oracle-fusion-middleware-now-exploited/ https://sploitus.com/exploit?id=MSF:EXPLOIT-MULTI-HTTP-ORACLE_ACCESS_MANAGER_RCE_CVE_2021_35587-
Related VulnerabilitiesPoCCVE-2026-59177: ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard AccessPoCCVE-2026-81578: PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-DirectPoCCVE-2026-82329: JFrog Artifactory Access Blank Join Key Authentication BypassPoCCVE-2026-86206: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header SpoofingPoCCVE-2026-86426: LibreNMS <= 26.7.0 - Unauthenticated API Access旭辰資訊|SmartIT Desktop Manager - 存在4個漏洞PoCgrafana-loki-api-exposure: Grafana Loki - Unauthenticated API Access中成科信票务管理系统 /SystemManager/TicketSystem/ReturnTicketPlance.ashx SQL 注入漏洞中成科信票务管理系统 /SystemManager/Planetarium/ReserveTicketManagerPlane.ashx SQL 注入漏洞大华-智慧园区综合管理平台 updateAccessChannelByVisit SQL注入漏洞PoCCVE-2020-10204: Sonatype Nexus Repository Manager 3 - Remote Code ExecutionPoCccm-detect: Clear-Com Core Configuration Manager Panel - Detect智慧物联网综合服务平台ListFileManager存在目录枚举漏洞