1. Home
  2. Vulnerabilities
  3. CVE-2025-61757
Known Exploited Vulnerability
9.8
CRITICAL CVSS 3.1
CVE-2025-61757
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability - [Actively Exploited]
Overview
Description

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Details
INFO

Published Date :

Oct. 21, 2025, 8:20 p.m.

Last Modified :

Nov. 24, 2025, 1:38 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://www.oracle.com/security-alerts/cpuoct2025.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61757

Impact
Affected Products

The following products are affected by CVE-2025-61757 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Oracle identity_manager
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL [email protected]
Solution
Update Oracle Identity Manager to the latest security patch.
  • Apply the relevant Oracle Critical Patch Update advisory.
  • Patch Identity Manager software to version 12.2.1.4.0 or later.
  • Patch Identity Manager software to version 14.1.2.1.0 or later.
Public PoC/Exploit Available at Github

CVE-2025-61757 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-61757.

URL Resource
https://www.oracle.com/security-alerts/cpuoct2025.html Vendor Advisory
https://isc.sans.edu/diary/rss/32506 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757 US Government Resource
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-61757 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-61757 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
Jinxia62/Oracle-Identity-Manager-CVE-2025-61757

Oracle Identity Manager 远程代码执行漏洞CVE-2025-61757

Python

Updated: 4 months ago
4 stars 0 fork 0 watcher
Born at : Nov. 21, 2025, 8:25 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
B1ack4sh/Blackash-CVE-2025-61757

CVE-2025-61757

Python

Updated: 4 months ago
0 stars 1 fork 1 watcher
Born at : Nov. 20, 2025, 1:04 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
0xPThree/Oracle

None

Python Java Go Shell

Updated: 3 months, 3 weeks ago
1 stars 0 fork 0 watcher
Born at : Oct. 5, 2024, 3:01 p.m. This repo has been linked 7 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-61757 vulnerability anywhere in the article.

  • Help Net Security
Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992)

Oracle has released an out-of-band patch for a critical and easily exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager. The company did not say whethe ... Read more

Published Date: Mar 23, 2026 (2 days, 7 hours ago)
  • TheCyberThrone
Oracle Patches CVE-2026-21992 — Unauthenticated RCE

OverviewOracle has released security updates to address a critical vulnerability impacting Oracle Identity Manager and Oracle Web Services Manager that could be exploited to achieve remote code execut ... Read more

Published Date: Mar 22, 2026 (3 days, 5 hours ago)
  • The Hacker News
Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager

Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be exploited to achieve remote code execution. The vulnerability ... Read more

Published Date: Mar 21, 2026 (4 days, 8 hours ago)
  • The Register
Clop's Oracle EBS rampage reaches Dartmouth College

Dartmouth College has confirmed it's the latest victim of Clop's Oracle E-Business Suite (EBS) smash-and-grab. According to a breach notification filed with Maine's attorney general, the New Hampshire ... Read more

Published Date: Nov 25, 2025 (4 months ago)
  • The Cyber Express
CISA Adds Oracle Identity Manager Vulnerability to KEV Database

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an Oracle Identity Manager vulnerability to its Known Exploited Vulnerabilities database after the SANS Internet Storm Center ... Read more

Published Date: Nov 24, 2025 (4 months ago)
  • The Register
CISA orders feds to patch Oracle Identity Manager zero-day after signs of abuse

CISA has ordered US federal agencies to patch against an actively exploited Oracle Identity Manager (OIM) flaw within three weeks – a scramble made more urgent by evidence that attackers may have been ... Read more

Published Date: Nov 24, 2025 (4 months ago)
  • CybersecurityNews
CISA Warns of Oracle’s Identity Manager RCE Vulnerability Actively Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to immediately address a critical security flaw in Oracle Identity Manager following reports of active exploitation. ... Read more

Published Date: Nov 24, 2025 (4 months ago)
  • TheCyberThrone
Critical Oracle Identity Manager Vulnerability Added to CISA KEV Catalog

November 22, 2025CISA officially added a critical vulnerability, CVE-2025-61757, to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgent need for organizations using Oracle Ident ... Read more

Published Date: Nov 22, 2025 (4 months ago)
  • security.nl
VS meldt actief misbruik van kritiek RCE-lek in Oracle Identity Manager

Aanvallers maken actief misbruik van een kritieke kwetsbaarheid in Oracle Identity Manager, zo laat het Amerikaanse cyberagentschap CISA weten. Gisteren verscheen er berichtgeving dat het beveiligings ... Read more

Published Date: Nov 22, 2025 (4 months ago)
  • The Hacker News
CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability

Nov 22, 2025Ravie LakshmananZero-Day / Software Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting Oracle Identity Manager t ... Read more

Published Date: Nov 22, 2025 (4 months ago)
  • BleepingComputer
CISA warns Oracle Identity Manager RCE flaw is being actively exploited

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning government agencies to patch an Oracle Identity Manager tracked as CVE-2025-61757 that has been exploited in attacks, potentia ... Read more

Published Date: Nov 21, 2025 (4 months ago)
  • security.nl
Kritiek RCE-lek in Oracle Identity Manager mogelijk misbruikt bij aanvallen

Een kritieke kwetsbaarheid in Oracle Identity Manager is mogelijk weken voor het uitkomen van een beveiligingsupdate misbruikt door aanvallers, zo meldt het Internet Storm Center (ISC). Op 21 oktober ... Read more

Published Date: Nov 21, 2025 (4 months ago)
  • The Hacker News
ThreatsDay Bulletin: 0-Days, LinkedIn Spies, Crypto Crimes, IoT Flaws and New Malware Waves

Nov 20, 2025Ravie LakshmananCybersecurity / Hacking News This week has been crazy in the world of hacking and online security. From Thailand to London to the US, we've seen arrests, spies at work, a ... Read more

Published Date: Nov 20, 2025 (4 months ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-61757 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Nov. 24, 2025

    Action Type Old Value New Value
    Added Reference Type CISA-ADP: https://isc.sans.edu/diary/rss/32506 Types: Third Party Advisory
    Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757 Types: US Government Resource
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Nov. 22, 2025

    Action Type Old Value New Value
    Added Date Added 2025-11-21
    Added Due Date 2025-12-12
    Added Required Action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    Added Vulnerability Name Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Nov. 21, 2025

    Action Type Old Value New Value
    Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Nov. 20, 2025

    Action Type Old Value New Value
    Added Reference https://isc.sans.edu/diary/rss/32506
  • Initial Analysis by [email protected]

    Oct. 24, 2025

    Action Type Old Value New Value
    Added CPE Configuration OR *cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*
    Added Reference Type Oracle: https://www.oracle.com/security-alerts/cpuoct2025.html Types: Vendor Advisory
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 22, 2025

    Action Type Old Value New Value
    Added CWE CWE-306
  • New CVE Received by [email protected]

    Oct. 21, 2025

    Action Type Old Value New Value
    Added Description Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added Reference https://www.oracle.com/security-alerts/cpuoct2025.html
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact