ZeroDay Findings
Sign inSign up

Findings

CVE-2021-22502

Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability

Published Feb 8, 2021 · updated Jun 16, 2026 · microfocus operation bridge reporter

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 8, 2021 · Catalog

    Detected

    Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Nov 17, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

Required action

Apply updates per vendor instructions.

CISA due date Nov 17, 2021

Affected

  • cpe microfocus/operation bridge reporter10.40
  • vendor Micro Focus Operation Bridge Reporter (OBR)version unspecified

Sources

  • CISA KEVCVE-2021-22502

    Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.

    cisa.gov
  • CVE.orgCVE-2021-22502

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-22502

    30-day exploitation probability 96.7%

    first.org
  • Metasploit Modulesexploit_linux/http/microfocus_obr_cmd_injection

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2021-22502

    Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

    nvd.nist.gov
  • Packet Storm Securityttp://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References