CVE-2021-35587: Oracle Access Manager - Remote Code Execution
HoneyLabs honeypots recorded 2 probes matching CVE-2021-35587 from 1 distinct source IP address in the last 7 days. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2022-11-28.
What the sensors show
All of them arrived on one day, 2026-11-05. It is still being probed 3 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 23 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i251000_b78ed14e2fd0_f50d94e863eb.
Request paths that identify it
- /oam/server/opensso/sessionservice
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 176.123.11.108 | 2 | Alexhost S.r.l. | Moldova |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS200019 | Alexhost S.r.l. | 2 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| Moldova | 2 |
Captured requests
- /oam/server/opensso/sessionservice
HTTP client fingerprints
- b11cun030_00040012_13ee3d34
CVE report
Open a specific CVE from the CVE tracker.