CVE-2021-22506VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-22506: Micro Focus Access Manager Information Leakage Vulnerability

Affects Micro Focus Micro Focus Access ManagerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
EPSS: 25.7% chance of exploitation in 30 days – higher than 97% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-22506 (opens in a new tab)

Description

Micro Focus Access Manager has an information leakage vulnerability due to a SAML service provider redirection issue involving the Assertion Consumer Service URL. This vulnerability has been exploited in the wild and is considered high severity.

Summary

CVE-2021-22506 describes an information leakage vulnerability in Micro Focus Access Manager. The flaw arises from improper handling of the SAML service provider redirection when the Assertion Consumer Service URL is used, potentially exposing sensitive information. The vulnerability has been observed to be exploited in the wild.

Impact

Successful exploitation can lead to unauthorized disclosure of sensitive information due to improper redirection handling in the SAML authentication process. This may aid attackers in further attacks or reconnaissance.

Mitigation

No specific patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:20:17 UTC

References

Related threats