# CVE-2021-35587: Critical RCE in Oracle Identity Manager Patched

> Oracle issues emergency patches for CVE-2021-35587, a critical RCE flaw in Identity Manager with a 9.8 CVSS score. Immediate mitigation is required.

- Published: 2026-03-23T08:26:13.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: CVE-2021-35587, Oracle Identity Manager, RCE, Security Update
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/oracle-releases-emergency-patch-for-critical-identity-manager-vulnerability/
- Canonical: https://runtimerebel.com/blog/cve-2021-35587-critical-rce-in-oracle-identity-manager-patched

## Key points

- Unauthenticated attackers can execute arbitrary code on Oracle Identity Manager servers, leading to full takeover of enterprise identity and access controls.
- Vulnerable systems include Oracle Identity Manager versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0 within the Oracle Fusion Middleware suite.
- Administrators must apply the emergency security update immediately and restrict network access to management ports to prevent unauthorized remote exploitation.

Oracle has released an emergency out-of-band security update to address a [critical](/glossary#cvss) vulnerability affecting its Identity Manager product. The [CVE](/glossary#cve) identified as [CVE-2021-35587](/cve/cve-2021-35587) carries a [CVSS](/glossary#cvss) v3.1 base score of 9.8, indicating the highest level of risk to enterprise environments. According to [SecurityWeek](https://www.securityweek.com/oracle-releases-emergency-patch-for-critical-identity-manager-vulnerability/), this flaw allows an unauthenticated attacker to achieve [RCE](/glossary#rce) over the network without requiring any user interaction.

## Technical Analysis of the Identity Manager Flaw

Oracle Identity Manager (OIM) is a foundational component of modern enterprise [Zero Trust](/glossary#zero-trust) and identity governance architectures. It manages the lifecycle of user identities and their corresponding access rights across various applications and platforms. Because OIM acts as a central repository for credentials and permissions, any vulnerability within this system represents a massive risk. 

This specific vulnerability exists in the Oracle Infrastructure component of the Fusion Middleware. The flaw is rooted in an insecure deserialization or improper input validation process within the web-based management interface. Attackers can exploit this by sending a specially crafted HTTP request to the vulnerable server. Since the exploit does not require valid credentials, it is highly likely to be targeted by an [APT](/glossary#apt) or other sophisticated threat actors seeking an initial foothold in a high-value network.

If successful, an attacker can execute arbitrary commands with the same privileges as the application server. Given that OIM typically requires high-level system permissions to modify user accounts and access policies, this compromise can lead to total domain takeover and facilitate [Lateral Movement](/glossary#lateral-movement) throughout the environment.

## Detection and Monitoring Strategies

Security teams researching **how to detect CVE-2021-35587 exploit** should prioritize the analysis of web server access logs. Look for anomalous POST requests directed at `/oam/server` or related internal OIM endpoints. Furthermore, because this vulnerability involves unauthorized command execution, monitoring for suspicious child processes is essential. If an [EDR](/glossary#edr) or [SIEM](/glossary#siem) platform detects the Java application server process spawning shell commands like `cmd.exe`, `/bin/sh`, or network utilities like `curl` and `wget`, it may indicate an active compromise.

As the [SOC](/glossary#soc) team investigates potential [IoC](/glossary#ioc) data, they should also look for unexpected modifications to identity attributes or the creation of new, unauthorized administrative accounts. These are common post-exploitation [TTP](/glossary#ttp) patterns used by attackers to maintain persistence after an initial [Zero-Day](/glossary#zero-day) or critical flaw is exploited.

## Oracle Identity Manager 12.2.1.4.0 Patch Guidance and Remediation

The primary mitigation for this threat is the immediate application of the official security patches provided by Oracle. The vulnerability impacts Oracle Identity Manager versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0. Adhering to the **Oracle Identity Manager 12.2.1.4.0 patch guidance** requires administrators to download the specific Critical Patch Update (CPU) and follow the associated readme instructions for their specific environment.

Until the patch can be applied, organizations should take the following steps:

*   **Network Segmentation**: Restrict access to the Oracle Identity Manager web interface to a trusted management network or via a secure VPN. This interface should never be exposed directly to the public internet.
*   **Traffic Filtering**: Implement Web Application Firewall (WAF) rules to block suspicious Java-related payloads and unauthorized access attempts to OIM administrative endpoints.
*   **Incident Response Readiness**: Ensure that all logs from the Oracle Fusion Middleware are being ingested by the [SIEM](/glossary#siem) for retroactive searching in the event that a breach is confirmed.

Given the high CVSS score and reports that this vulnerability may have been exploited in the wild, defenders must treat this as a top-tier remediation priority.

**Related:** [Oracle Identity Manager RCE via CVE-2026-21992 — Patch Now](/blog/oracle-identity-manager-rce-via-cve-2026-21992-patch-now), [Automated Reconnaissance Targeting React2Shell Implementations](/blog/automated-reconnaissance-targeting-react2shell-implementations)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2021-35587-critical-rce-in-oracle-identity-manager-patched