CVEvulnerability

CVE-2021-22502

9.8 CRITICAL Known exploited Published 2021-02-08 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability — Micro Focus Operation Bridge Reporter (OBR)

Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.

Added to KEV: 2021-11-03
Remediation due: 2021-11-17
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-22502

Status: Analyzed
Published: 2021-02-08
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses: CWE-78

Description

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

Affected configurations

• microfocus operation bridge reporter 10.40

Weakness · CWE (1)

CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References