CVE-2025-61757

CVE-2025-61757 is a critical missing-authentication flaw (CWE-306) in the REST WebServices component of Oracle Identity Manager, part of Oracle Fusion Middleware, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access can send HTTP requests to the REST endpoints without any credentials or user interaction. Successful exploitation results in takeover of Identity Manager, with high-impact confidentiality, integrity, and availability consequences (CVSS 3.1 base score 9.8). Any organization running the affected versions of Oracle Identity Manager — typically large enterprises and public-sector organizations using it for identity and access management — is exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-11-21, news reports describe it as an actively exploited zero-day, and EPSS assigns an 88.3% probability of exploitation within 30 days.

What to do: Immediately apply Oracle's fix for CVE-2025-61757 to Identity Manager 12.2.1.4.0 and 14.1.2.1.0 per Oracle's security advisory (federal agencies must follow BOD 22-01 timelines). Until patching is complete, restrict untrusted and internet-facing HTTP access to the Identity Manager REST WebServices endpoints, and review logs for signs of compromise given confirmed in-the-wild exploitation. Also verify that the separate unauthenticated RCE in Identity Manager (CVE-2026-21992), which Oracle has patched, is remediated in the same maintenance cycle.