CVE-2021-22506
Published: November 3, 2021
Official Description
Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.
CISA KEV Advisory
Micro Focus Access Manager Information Leakage Vulnerability
Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.
Apply updates per vendor instructions.
Risk Analysis
Micro Focus Access Manager has an information leakage vulnerability due to a SAML service provider redirection issue. This high-severity flaw has a significant exploitation probability (EPSS 0.10545), indicating a strong likelihood of being exploited. This vulnerability is confirmed to be actively exploited by CISA.
This vulnerability is being actively exploited in the wild. The nature of the flaw suggests it could be exploited remotely.
Apply all available security updates for Micro Focus Access Manager. Ensure proper configuration of SAML service provider settings to prevent redirection issues.
Technical Analysis
CVE-2021-22506 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2021-22506 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2021-22506 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1