CVE-2021-35464VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-35464: ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

Affects ForgeRock Access Management (AM)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
Ransomware: Used in ransomware campaigns
EPSS: 100.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-35464 (opens in a new tab)

Description

CVE-2021-35464 is a remote code execution vulnerability in ForgeRock Access Management (AM) Core Server. An attacker can exploit this by sending a specially crafted HTTP request to one of three specific endpoints, allowing code execution with the privileges of the current user. The vendor advises against running ForgeRock AM as the root user to reduce risk. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

Summary

ForgeRock Access Management (AM) Core Server contains a remote code execution vulnerability identified as CVE-2021-35464. The flaw is triggered when an attacker sends a specially crafted HTTP request to one of the three endpoints: /ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame. Successful exploitation allows execution of arbitrary code in the context of the current user running the ForgeRock AM service. Running the service as root increases the risk, which the vendor does not recommend. This vulnerability has been observed exploited in the wild and linked to ransomware campaigns.

Impact

Exploitation of this vulnerability allows an attacker to execute arbitrary code on the ForgeRock AM server with the privileges of the user running the service. If the service runs with elevated privileges, the impact is more severe. This can lead to full system compromise and has been leveraged in ransomware attacks.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor recommends not running ForgeRock AM as the root user to reduce risk. Due to known exploitation in the wild, organizations should monitor vendor channels for patches or official fixes and apply them promptly once available.

Weaknesses

CWE-502Deserialization of Untrusted Data (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:26:37 UTC

Weaknesses

References

Related threats