Critical severity9.8CISA KEVNVD Advisory· Published Jul 22, 2021· Updated Jun 17, 2026

CVE-2021-35464

Description

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Forgerock/Access Management
cpe:2.3:a:forgerock:access_management:*:*:*:*:*:*:*:*
Range: <6.5.4
Forgerock/Openam2 versions
cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*range: >=9.0.0,<14.6.3
- (no CPE)range: <7.0
ForgeRock/AM serverdescription
Forgerock/AM serverllm-fuzzy
Range: <7.0

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.htmlnvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
backstage.forgerock.com/knowledge/kb/article/a47894244nvdExploitPermissions RequiredVendor Advisory
bugster.forgerock.orgnvdBroken Link
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.080
exploit	0.030
kev	0.120
patch	0.000
ransomware	0.060