A security researcher named Wolfgang Ettlinger from SEC Consult Vulnerability Lab has identified a critical vulnerability in Oracle Fusion Middleware Access Manager which has been actively exploited in-the-wild according to the Cybersecurity and Infrastructure Security Agency (CISA). Its active exploitation landed the vulnerability on CISA’s Known Exploited Vulnerabilities (KEV) catalog. Successful exploitation could allow a remote attacker to bypass authentication and perform remote code execution (RCE), taking complete control over any user account. Oracle Access Manager (OAM) is the authorization component of Oracle Fusion Middleware, providing authentication like “Web SSO with MFA, coarse-grained authorization and session management, and standard SAML Federation and OAuth capabilities to enable secure access to mobile applications and external cloud.” An attacker could trick the OAM into disclosing user account information, performing a padding oracle attack to capture the target account’s authorization cookie. From there, the attacker could develop a script that generates login keys for any users including admin accounts. In his report, Ettlinger includes a video proof-of-concept (PoC), taking the exploit from start to finish. The vulnerability, tracked as CVE-2021-35587, was originally patched in January 2022 and has been exploited at least ten (10) times according to CISA. Its presence on the KEV dictates that all Federal Civilian Executive Branch (FCEB) agencies must patch their vulnerable systems by no later than December 19, 2022. At this time, there is no specific information about the threat actors themselves, however the attacks seem to originate from the United States, China, Germany, Singapore, and Canada. CTIX recommends all Oracle Fusion Middleware Access Manager administrators ensure that they have installed the latest patch to prevent exploitation.