CVE-2021-22502: Micro Focus Operation Bridge Reporter OS command injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network remote code execution with a CVSS of 9.8, KEV listing, and near-maximum EPSS probability.

What it is

Micro Focus Operation Bridge Reporter (OBR) version 10.40 contains an OS command injection flaw (CWE-78) that permits remote code execution on the OBR server. It is network-reachable with no privileges or user interaction required, and it is listed in CISA's Known Exploited Vulnerabilities catalog, so it warrants urgent remediation.

Impact

An unauthenticated attacker can execute arbitrary operating system commands on the OBR server, gaining full control of that host and its data.

Attack surface

Reachable over the network via the OBR service; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed.

Exploitation

Listed in CISA KEV with a 2021-11-17 remediation due date, and EPSS probability is 0.9674 (99.88th percentile); public exploit code is referenced (Packet Storm, ZDI advisories). No ransomware campaign use is documented.

What to do

• Apply the vendor update per Micro Focus advisory KM03775947 (CISA required action).
• If patching cannot be done immediately, isolate OBR servers from untrusted networks and restrict access to trusted management hosts only.
• Audit for OBR 10.40 instances and confirm no unauthorized changes or persistence on the host.
• Monitor and block exploit attempts against the OBR service at network and host boundaries.

Detection

• Inspect OBR server and web logs for command-injection payloads or unexpected shell metacharacters in requests.
• Monitor for unexpected child processes spawned by the OBR service (e.g., shell or command interpreters).
• Alert on outbound connections or file writes from the OBR host that deviate from baseline behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.