Is CVE-2021-22506 (Micro Focus Access Manager Information Leakage) being exploited in the wild?

Yes. CISA added CVE-2021-22506 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.

How to confirm this vulnerability is being exploited in the wild

The practical answer is to treat any KEV-listed CVE as an active exploitation signal, not a theoretical exposure. For this case, that means verifying whether your environment contains the affected Micro Focus Access Manager components and whether the SAML redirection path is externally reachable. If it is internet-facing, the question is not whether exploitation is possible, but whether you have already exposed the vulnerable path long enough to be targeted.

Use authoritative sources first: the CISA Known Exploited Vulnerabilities Catalog confirms exploitation status, while the CVE Program and vendor advisory give the authoritative vulnerability record and product guidance. For triage workflow, NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is useful because it frames KEV as a response trigger, not a background metric.

Operationally, the key checks are simple: confirm asset ownership, confirm exposure, confirm patch or mitigation status, and confirm whether the vulnerable endpoint has been reachable from untrusted networks. If you cannot answer those four points quickly, you are already behind on response.

What the information leakage issue means for defenders

This is an information leakage flaw in Micro Focus Access Manager tied to SAML service provider redirection when the Assertion Consumer Service URL is used. In practice, that means the exposed behaviour is about trust in the redirection path, not just a generic application bug. Even when the primary symptom is disclosure rather than code execution, leaked information can still support reconnaissance, session abuse, or follow-on attack planning.

That is why teams should read this as a control problem as much as a vulnerability problem. When identity federation and redirection logic are part of the attack surface, small validation failures can expose details that should never be visible to unauthenticated or lower-trust users. The issue is most serious where Access Manager sits in front of high-value applications or where exposed metadata helps an attacker understand how authentication is routed.

For defenders who need a broader pattern view, NHIMG’s Vulnerability Management Guide is a useful companion because it ties KEV status to prioritisation, verification and exposure management rather than simple patch counting.

What to do if patching has to wait

If you cannot remediate immediately, reduce exposure in the shortest path available: restrict network reachability, remove unnecessary public exposure, and tighten any upstream reverse proxy or edge controls that can reduce access to the vulnerable flow. If the application is used for authentication, that delay should be treated as a temporary acceptance of exploitation risk, not as a neutral maintenance window.

When a vulnerability sits in a trust and redirection path, compensating controls should focus on reachability and observation, not just perimeter assumptions. Log review, authentication-flow monitoring, and targeted traffic inspection are the right short-term tools because they help you see whether the vulnerable behaviour is being probed or abused before a formal fix lands.

If you need a broader control lens while you hold the line, NHIMG’s Application Security Posture Management (ASPM) Guide helps connect exposure, reachability and business context, which is exactly what matters when a flaw is live and remediation is deferred.

Risk and Threat Considerations

KEV inclusion means the risk is no longer abstract. Attackers often target these flaws because they are already proven to work against real deployments, and information leakage in an identity or federation component can help them map the environment, identify trust relationships, or prepare a follow-on compromise.

Failure mechanism: The vulnerable redirection path can disclose information during SAML service provider handling, especially when the Assertion Consumer Service URL is processed in a way that exposes unintended details.

Impact: Exposed information can support reconnaissance, accelerate exploitation attempts, and increase the chance that adjacent authentication or session controls are targeted next.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed CVEs require fast exposure verification and remediation prioritisation.
Recommendation — Prioritise remediation for KEV-listed vulnerabilities and validate that exposed assets are fixed or contained.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Active exploitation makes flaw remediation the core operational control for this CVE.
	RA-5 — Vulnerability Monitoring and Scanning	You need scanning and exposure verification to confirm whether the vulnerable product is present and reachable.
	AU-6 — Audit Record Review, Analysis, and Reporting	Monitoring authentication and redirection activity helps detect probing or abuse of the leak path.
Recommendation — Track, remediate, and verify vulnerable components promptly when exploitation is confirmed. Continuously scan for the vulnerable product and confirm external exposure before relying on patch status. Review logs for suspicious requests against the affected authentication flow and escalate anomalies quickly.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	This is a live vulnerability management case requiring remediation, exception handling, and verification.
Recommendation — Maintain a vulnerability process that identifies, prioritises, and remediates KEV-listed flaws quickly.

Practitioner Guidance

What to verify: Confirm whether the vulnerable Access Manager deployment is internet-facing, whether the affected flow is reachable, and whether logging is sufficient to show requests against the SAML endpoint and redirection path.

Decision rule: If the system mediates authentication for users or applications, treat the issue as priority remediation even when the leak looks minor, because disclosure in a trust boundary often becomes an attacker’s map for the next step.

Practitioner takeaway: A KEV-listed information disclosure issue should be handled as active exposure management, not as a low-grade bug, because the real danger is often the intelligence it gives an attacker before the breach.