CVE-2021-35587

Oracle has handed security teams their first big patching workload of the year, with its latest quarterly update containing a hefty 337 security fixes across its product range, including 27 rated critical. This imposing number of patches won’t surprise anyone whose job it is to look after Oracle products; in 2025 the company averaged 344 […]

Oracle has finally admitted to suffering a significant data breach, quietly notifying select customers about the security incident just days after being hit with a class action lawsuit that accused the tech giant of attempting to conceal the breach from affected users. The company’s acknowledgment comes after weeks of denials and represents a significant change […]

Despite Oracle categorically denying that its Cloud systems have been breached, sample data released by the hacker seems to prove otherwise.

Oracle has denied that Cloud systems have been breached after a hacker claimed to have stolen millions of records.

A threat actor has reportedly breached Oracle Cloud infrastructure, exfiltrating six million sensitive authentication records and potentially endangering more than 140,000 enterprise customers. The attacker is now demanding ransom payments while actively marketing the stolen data on underground forums, according to threat intelligence firm CloudSEK. Security researchers at CloudSEK’s XVigil team discovered the breach on […]

The cybercrime underground has long functioned as an open market where sellers of products and services are paired with buyers and contractors. One of the most valuable commodities on this market are stolen credentials since they can provide attackers with access into networks, databases, and other assets owned by organizations. It’s no surprise to see […]

For the latest discoveries in cyber research for the week of 5th December, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Cyber criminals who breached Australian Medibank’s systems have released another batch of data onto the dark web, claiming that the files contain all data harvested in the former heist that impacted 9.7 […]

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The top 200 most common passwords in 2022 are bad, mkay? According to NordPass’ latest list of top 200 most common passwords in 2022, “password” is the most popular choice, followed by “123456”, “123456789”, “guest” and “qwerty“. Pre-auth RCE in Oracle Fusion Middleware exploited in the wild (CVE-2021-35587) A pre-authentication RCE flaw (CVE-2021-35587) in Oracle Access Manager (OAM) that has … More →

CISA added a critical flaw impacting Oracle Fusion Middleware, tracked as CVE-2021-35587, to its Known Exploited Vulnerabilities Catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability impacting Oracle Fusion Middleware, tracked as CVE-2021-35587 (CVSS 3.1 Base Score 9.8), to its Known Exploited Vulnerabilities Catalog. An unauthenticated attacker with network access via HTTP can […]

The US Cybersecurity and Infrastructure Security Agency (CISA) on Monday warned organizations that a critical Oracle Fusion Middleware vulnerability patched in early 2022 is being exploited in attacks.

A pre-authentication RCE flaw (CVE-2021-35587) in Oracle Access Manager (OAM) that has been fixed in January 2022 is being exploited by attackers in the wild, the Cybersecurity and Infrastructure Security Agency has confirmed by adding the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. About CVE-2021-35587 CVE-2021-35587 was discovered by security researchers “Jang” (Nguyen Jang) and “Peterjson” in late 2021 by accident, while “building PoC for another mega-0day.” The vulnerability is in the OpenSSO Agent … More →