PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-35587 Oracle CVE debrief

CVE-2021-35587 is an Oracle Fusion Middleware vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2022-11-28. The supplied source material does not describe the exact weakness or impact, so the safest conclusion is that it is a confirmed exploitation risk requiring prompt patching per Oracle's guidance. Because CISA set a remediation due date of 2022-12-19, organizations should treat this as an urgent maintenance item rather than a routine advisory.

Vendor
Oracle
Product
Fusion Middleware
CVSS
CRITICAL 9.8
CISA KEV
Listed
Original CVE published
2022-11-28
Original CVE updated
2022-11-28
Advisory published
2022-11-28
Advisory updated
2022-11-28

Who should care

Oracle Fusion Middleware administrators, application owners, patch management teams, and security operations staff responsible for internet-facing or business-critical middleware deployments.

Technical summary

The source corpus identifies the issue only as an "Oracle Fusion Middleware Unspecified Vulnerability." No CVSS score, attack vector, or impact details are provided in the supplied material. What is confirmed is that CISA categorized it as a known exploited vulnerability and linked remediation to Oracle's January 2022 security update guidance. In practical terms, defenders should assume exposure is meaningful enough to justify expedited patching and verification across Oracle Fusion Middleware instances.

Defensive priority

Urgent. The CISA KEV listing indicates known exploitation, and the published remediation due date in the supplied timeline is 2022-12-19.

Recommended defensive actions

  • Apply Oracle's vendor-provided updates and mitigation guidance for Fusion Middleware as soon as possible.
  • Inventory all Oracle Fusion Middleware deployments, including internet-facing and indirectly exposed instances.
  • Verify patch status against Oracle's January 2022 CPU guidance referenced by CISA.
  • Prioritize remediation and validation before and after the KEV due date.
  • Monitor affected systems for anomalous activity until updates are confirmed installed.
  • Document any exceptions and track them to closure with a short remediation SLA.

Evidence notes

This debrief uses only the provided source corpus and official links. Primary evidence comes from CISA KEV metadata identifying the vulnerability as known exploited and naming Oracle Fusion Middleware as the affected product. The source item notes point to Oracle's January 2022 CPU and the NVD record, but the supplied corpus does not include detailed vulnerability mechanics, so no unsupported impact claims are made.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-35587 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-35587

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-35587 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-35587

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.