CVE-2021-22502

CVE-2021-22502 is an unauthenticated OS command injection flaw (CWE-78) in Micro Focus Operation Bridge Reporter (OBR) version 10.40, rated critical (CVSS 9.8) because it is reachable over the network with no privileges or user interaction required. By sending crafted input to the exposed OBR service, an attacker can inject operating-system commands that are executed directly on the OBR server. Successful exploitation yields full remote code execution with the privileges of the affected service, giving attackers a foothold in enterprise IT operations environments. Organizations running OBR 10.40 — an enterprise IT-operations analytics/reporting server — are affected, particularly where the OBR interface is reachable from untrusted networks. Exploitation status is high-concern: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, a public proof-of-concept for unauthenticated command injection exists, and EPSS puts the 30-day exploitation probability at 96.7% (top percentile).

What to do: Apply the vendor update for Operation Bridge Reporter per Micro Focus/OpenText instructions, as required by the CISA KEV catalog; confirm the deployed OBR build resolves 10.40. Until patched, restrict network access to the OBR server (firewall rules, VPN-only access) and hunt for signs of compromise such as unexpected processes, suspicious outbound connections, or web-shell artifacts on the server.