CVE-2021-35464: ForgeRock AM JATO deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS score of 9.8, confirmed exploitation in CISA KEV, near-certain EPSS probability, and documented ransomware use.

What it is

ForgeRock Access Management (AM) server before 7.0 deserializes untrusted data from the jato.pageSession parameter on multiple pages, a flaw inherited from the Sun ONE Application Framework (JATO) present in Java 8 and earlier. A single crafted /ccversion/* request can trigger remote code execution without authentication, making this a severe pre-auth flaw for internet-facing AM deployments.

Impact

An unauthenticated attacker can execute arbitrary code on the AM server, gaining full control of the host and access to identity data and downstream systems it brokers.

Attack surface

Reachable over the network via HTTP requests to the /ccversion/* endpoint with a crafted jato.pageSession parameter; no authentication and no user interaction are required per the CVSS vector and description.

Exploitation

Listed in CISA KEV with a 2021-11-03 addition and known ransomware campaign use, and EPSS probability is effectively 1.0; public exploit code is referenced on Packet Storm and the vendor advisory.

What to do

• Upgrade ForgeRock AM to version 7.0 or later, or apply the vendor-supplied fix referenced in the ForgeRock knowledge base article.
• If immediate patching is not possible, restrict network access to AM endpoints, especially /ccversion/*, to trusted sources only.
• Run AM on a Java version that does not include the vulnerable JATO classes where supported by the vendor.
• Rotate credentials and secrets stored or processed by the AM server if compromise is suspected.
• Monitor vendor advisories and CISA KEV for updated guidance and required actions.

Detection

• Inspect web server and AM logs for requests to /ccversion/* paths, particularly with a jato.pageSession parameter.
• Alert on unexpected child processes or command execution spawned by the AM server's Java process.
• Monitor for anomalous outbound network connections from the AM host following HTTP requests.
• Review AM server file system and configuration changes for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.