VulnTideExploited vulnerabilities, by vendor. Data as of 28 Oct 2026.
Known exploitedIn CISA's KEV catalog since 3 November 2021Ransomware use: unknown
Micro Focus Micro Focus Access Manager

CVE-2021-22506: Micro Focus Access Manager Information Leakage Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 3 Nov 2021, 222 days after the CVE record was published.

How likely is exploitation in the next 30 days?
25.7%

EPSS score, percentile 98 of all scored records

How severe?
7.5 High

CVSS v3.1 base score, from CISA's enrichment of the record

What should I do?

CISA deadline 17 Nov 2021. Apply updates per vendor instructions.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

  • All version prior version 5.0.

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

Required action, set by CISA

Apply updates per vendor instructions.

CISA due date for this action: 17 November 2021.

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

n/a Access Manager.
StatusVersions
AffectedAll version prior version 5.0.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

  • CISA added CVE-2021-22506 to its Known Exploited Vulnerabilities (KEV) catalog on 3 Nov 2021.
  • CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
  • The due date CISA sets for the required action is 17 Nov 2021.
  • The CVE record was published on 26 Mar 2021, 222 days before it was added to KEV.
  • The CVE record carries a CVSS v3.1 base score of 7.5 (High), taken from CISA's enrichment of the record.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 25.7% (percentile 98), as of 28 Oct 2026.
  • CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact partial.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Timeline

DateEvent
26 Mar 2021CVE record published
3 Nov 2021Added to CISA KEV
17 Nov 2021CISA due date for the required action
21 Oct 2025CVE record last updated

References

More exploited Micro Focus vulnerabilities

  • CVE-2021-22502: Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability (added 3 Nov 2021)