CVE-2021-35464: ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days.

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier

Affected products

• ForgeRock Access Management: before 6.5.4 (fixed in 6.5.4)
• ForgeRock Openam: from 9.0.0, before 14.6.3 (fixed in 14.6.3)

Published 2021-07-22. Last modified 2026-06-17.