CISA Warns of Actively Exploited Critical Oracle Fusion Middleware Vulnerability

CVE-2021-35587 is a critical (CVSS 9.8) missing-authentication flaw (CWE-306) in the OpenSSO Agent component of Oracle Access Manager, part of Oracle Fusion Middleware. An unauthenticated attacker with network access can send crafted HTTP requests to the affected component and, because the endpoint requires no authentication, achieve takeover of Oracle Access Manager — effectively pre-authentication remote code execution with high impact on confidentiality, integrity, and availability. Organizations running Oracle Access Manager 11.1.2.3.0, 12.2.1.3.0, or 12.2.1.4.0 are affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-11-28, and security press reported more than 150 internet-exposed Oracle Access Management systems. EPSS assigns a 96.3% probability of exploitation within 30 days, although no public proof-of-concept code is known.

Do: Apply Oracle's update for CVE-2021-35587 per vendor instructions (delivered via the Oracle Critical Patch Update covering this flaw) to bring Access Manager 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0 to a fixed release; this is the required action in CISA's KEV entry. Until patched, restrict HTTP access to OpenSSO Agent/Access Manager endpoints at the perimeter and review access logs for signs of unauthenticated exploitation.

CVE-2022-4135 is a heap buffer overflow (CWE-787, out-of-bounds write) in the GPU process of Google Chromium, the browser engine behind Chrome and most other major browsers. It is triggered via a crafted HTML page and, per CISA, requires the attacker to have already compromised the browser's renderer process; the memory corruption in the GPU process can then be leveraged to escape the renderer sandbox. A successful attack moves the attacker out of the tightly restricted renderer sandbox toward the higher-privilege GPU process on the host, a step that can enable further code execution. All users of Chromium-based browsers are affected — CISA explicitly lists Google Chrome, Microsoft Edge, and Opera, among others — though no specific vulnerable version ranges are published in the source data. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-11-28, EPSS assigns a 31.9% probability of exploitation within 30 days (98th percentile), and no public proof-of-concept is known.

Do: Treat unpatched Chromium-based browsers as exposed and apply vendor updates immediately, per CISA's required action: update Google Chrome, Microsoft Edge, Opera, and any other Chromium-based browsers to the latest patched releases available as of the late-November 2022 KEV listing. Inventory managed endpoints for browser versions and verify auto-update is enabled, since the flaw is confirmed exploited in the wild even though no public PoC exists.