CVE-2021-35464

The vulnerability in the ForgeRock AM server arises from a critical flaw in the Java deserialization process associated with the jato.pageSession parameter. This issue is rooted in the usage of the Sun ONE Application Framework (JATO) within Java versions 8 and earlier. Java deserialization vulnerabilities are particularly dangerous as they allow an attacker to manipulate serialized objects, potentially leading to remote code execution. In this case, the flaw can be exploited by sending a specially crafted request to the server, which does not require any form of authentication. This lack of authentication significantly lowers the barrier for attackers, making it easier for them to execute malicious code on the server.

The attack vector for this vulnerability is straightforward yet highly effective. An attacker can craft a malicious request targeting the /ccversion/* endpoint of the affected server. By exploiting the deserialization flaw, the attacker can inject arbitrary code that the server will execute. This could lead to a range of malicious outcomes, including the installation of malware, data exfiltration, or even complete server takeover. Given that the exploitation does not necessitate user authentication, it poses a severe risk, as any unauthenticated user can initiate the attack. This ease of access amplifies the potential for widespread exploitation, particularly in environments where the ForgeRock AM server is deployed without adequate security measures.

The real-world impact of this vulnerability can be significant, especially for organizations relying on the ForgeRock AM server for identity and access management. Successful exploitation could lead to unauthorized access to sensitive data, disruption of services, and loss of customer trust. The business risks associated with such an incident include financial losses due to remediation efforts, potential regulatory fines for data breaches, and reputational damage that could affect customer relationships and market position. Organizations that fail to address this vulnerability may find themselves at a competitive disadvantage, as clients increasingly prioritize security in their vendor selection processes.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating software to the latest versions is crucial, as newer releases often include patches for known vulnerabilities. Additionally, employing web application firewalls (WAFs) can help filter out malicious requests before they reach the server. Monitoring logs for unusual access patterns or failed authentication attempts can also aid in early detection of potential exploitation attempts. Furthermore, organizations should conduct regular security assessments and penetration testing to identify and remediate vulnerabilities proactively.

In conclusion, the deserialization vulnerability in the ForgeRock AM server represents a critical risk that organizations must address promptly. The potential for remote code execution without authentication makes it particularly dangerous, and the implications of a successful attack can be far-reaching. By adopting robust detection and mitigation strategies, organizations can significantly reduce their exposure to this and similar vulnerabilities, thereby enhancing their overall security posture in an increasingly threat-laden digital landscape.

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting the ForgeRock AM deserialization vulnerability. Our telemetry indicates a doubling in detection frequency, reflecting increased attacker interest and activity. This surge coincides with the continued availability of multiple proof-of-concept exploits and the integration of this vulnerability into widely used penetration testing frameworks, which lowers the barrier for adversaries to execute remote code on vulnerable systems. The persistence of ransomware groups leveraging this flaw underscores its operational impact and the heightened risk to affected organizations. Consequently, the threat level associated with CVE-2021-35464 has intensified, reinforcing its status as a critical security concern that demands vigilant monitoring and response efforts.

Update 2 — June 16, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2021-35464, accompanied by an increase in the Exploit Prediction Scoring System (EPSS) score reaching its maximum value. This trend reflects growing adversary confidence and operational momentum, likely driven by the sustained availability of multiple proof-of-concept exploits and the integration of this vulnerability into mainstream penetration testing frameworks. Our telemetry indicates that threat actors, including ransomware groups, continue to leverage this unauthenticated remote code execution flaw to compromise ForgeRock Access Management servers, amplifying the potential for impactful intrusions. The elevated EPSS score and increased detection activity underscore a heightened likelihood of exploitation in the wild, signaling an urgent need for defenders to prioritize monitoring and incident response efforts. Consequently, the threat level associated with CVE-2021-35464 has intensified further, reinforcing its critical status within the current threat landscape.

Update 3 — July 06, 2026

CSURFACE threat intelligence has identified a notable surge in exploitation attempts targeting CVE-2021-35464, with our telemetry indicating increased adversary activity leveraging this unauthenticated remote code execution vulnerability. This uptick coincides with the emergence of additional proof-of-concept exploits and expanded Metasploit module usage, which collectively lower the barrier for threat actors, including ransomware groups, to weaponize the flaw. The persistence of stable but extremely high EPSS scores further confirms sustained attacker interest and operational viability. For defenders, this evolving landscape underscores an elevated risk of compromise through automated or opportunistic attacks, necessitating heightened vigilance in monitoring and detection capabilities. Consequently, the threat level associated with CVE-2021-35464 has escalated, reflecting a more active exploitation environment and reinforcing its critical priority within current security postures.