What’s Vulnerable › Vulnerabilities

CVE-2021-22502: Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 96.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-02-08 · updated 2026-06-17
• Weakness: CWE-78

Description

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

Affected products

• Operation Bridge Reporter.: 10.40

References

• http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html
• https://softwaresupport.softwaregrp.com/doc/KM03775947
• https://www.zerodayinitiative.com/advisories/ZDI-21-153/
• https://www.zerodayinitiative.com/advisories/ZDI-21-154/
• http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html
• https://softwaresupport.softwaregrp.com/doc/KM03775947
• https://www.zerodayinitiative.com/advisories/ZDI-21-153/
• https://www.zerodayinitiative.com/advisories/ZDI-21-154/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22502

Get alerted when CVE-2021-22502 or the next vulnerability affects your stack