Yes. CISA added CVE-2021-35587 to its Known Exploited Vulnerabilities catalogue on 28 November 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.
What “being exploited in the wild” means for this Oracle CVE
For this question, the key issue is not whether the flaw exists in theory, but whether attackers are already using it against exposed systems. Once CISA places a CVE in the KEV catalog, defenders should treat it as an active exploitation problem, not a future patching exercise. In practice, that changes triage priority, emergency change handling, and the need to look for signs of compromise.
The most useful first question is exposure: is Oracle Fusion Middleware Access Manager reachable from untrusted networks, and is the vulnerable service actually deployed? For a product that can be taken over through unauthenticated HTTP access, internet exposure and weak segmentation raise the likelihood that exploitation will succeed quickly once it is targeted. CISA Known Exploited Vulnerabilities Catalog is the authoritative place to confirm KEV status and action timing.
Because KEV inclusion reflects observed abuse, defenders should read this as a signal to verify inventory, not just patch status. If Oracle Fusion Middleware components are present anywhere in the environment, especially in externally reachable management or identity paths, they merit immediate validation against vendor guidance and an internal exposure review. Oracle security alerts remain the right source for product-specific remediation details.
Why active exploitation changes the response
When exploitation is already happening, the operational question becomes how quickly you can reduce exposure and whether an attacker may have already used the weakness to gain control. That means patching is necessary, but not sufficient. You also need to assume that any directly exposed instance may have been targeted before the remediation window closes.
Zero-Day and Exploited Vulnerabilities Guide is useful here because the response pattern is the same even when the issue is no longer a zero-day: validate exposure, accelerate remediation, and check for post-exploitation activity. The practical difference is that KEV-listed flaws generally justify a more aggressive timeline than ordinary vulnerability backlog work.
Active exploitation also changes what teams should preserve. If the affected Access Manager instance handled authentication or access traffic, an attacker may have been able to reach sensitive sessions, configuration data, or adjacent administrative paths. That does not mean compromise is guaranteed, but it does mean you should treat the system as potentially touched until you have checked logs, admin activity, and any unexpected configuration changes.
What to do if patching is delayed or the system is already suspect
If you cannot remediate immediately, reduce the attack surface first. Remove unnecessary internet exposure, restrict access to trusted admin paths, and isolate the component as far as possible from user-facing traffic. Temporary containment is especially important when the vulnerable service is directly reachable over HTTP, because that makes exploitation easier to automate and to repeat.
Where patching must wait, focus on evidence collection and blast-radius reduction rather than trying to guess whether attackers are present. Preserve authentication logs, reverse proxy logs, application logs, and any records of privilege changes or unexpected configuration edits. If the system supports federated or SSO-style access into other services, review whether the flaw could have exposed downstream trust relationships and rotate any dependent credentials that may have been reachable through the compromised path.
Vulnerability Management Guide is the best fit for the prioritisation side of this work because it frames KEV, remediation SLAs, verification, and exception handling as one workflow rather than separate tasks. The main judgement is to escalate this CVE above routine patch queues until you have either remediated it or confirmed the environment was not exposed.
Risk and Threat Considerations
This flaw is high risk because unauthenticated network reachability can collapse the normal barriers that protect an access-management component. Once a weakness like this is actively exploited, defenders should assume attackers will try to move from initial access to control-plane visibility, session abuse, or adjacent identity paths if the product is integrated into broader enterprise authentication flows.
Failure mechanism: The vulnerable service is reachable over HTTP without prior authentication, which can let an attacker trigger takeover conditions before normal access controls, monitoring, or manual review intervene.
Impact: A successful exploit can convert an externally reachable middleware component into a foothold for deeper compromise, with possible exposure of authentication flows, administrative trust, and connected systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerability Assessment | Actively exploited flaws require assessing exposure and likely impact. |
| Recommendation — Prioritise exposed assets with this flaw for immediate remediation and verification. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This CVE demands vulnerability identification and prioritized response. |
| SI-2 — Flaw Remediation | Active exploitation makes timely remediation the core control need. | |
| Recommendation — Scan for vulnerable Oracle Fusion Middleware instances and validate remediation status. Apply the vendor fix or mitigation as an emergency flaw-remediation action. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation is a continuous prioritization and remediation problem. |
| CIS-17 — Incident Response Management | Active exploitation also requires compromise assessment and response readiness. | |
| Recommendation — Prioritise this KEV-listed issue ahead of routine backlog items. Trigger incident-response review if exposure or compromise indicators are found. | ||
Practitioner Guidance
What to verify: Confirm whether Oracle Fusion Middleware Access Manager is deployed, whether it is reachable from the internet or semi-trusted networks, and whether any compensating controls actually block unauthenticated access.
Decision rule: If the asset is exposed and still unpatched, treat it as an emergency remediation item and do not wait for broader maintenance windows; if patching must wait, isolate the service and preserve logs first.
What practitioners underestimate: The main mistake is focusing only on the CVE fix and missing the possibility that access-manager compromise can have downstream impact on sessions, trust relationships, and related systems.
Practitioner takeaway: KEV inclusion means you should respond as though exploitation is already in circulation, with exposure review, rapid remediation, and compromise assessment happening together.
Related resources from NHI Mgmt Group
- Is CVE-2020-2551 (Oracle Fusion Middleware Unspecified) being exploited in the wild?
- CVE-2021-35587 (Oracle Fusion Middleware Unspecified)
- Is CVE-2021-25371 (Samsung Mobile Devices Unspecified) being exploited in the wild?
- Is CVE-2025-61882 (Oracle E-Business Suite Unspecified) being exploited in the wild?