CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-61757 | Unauthenticated Takeover of Oracle Identity Manager via REST WebServices CVE-2025-61757 is a critical missing-authentication flaw (CWE-306) in the REST WebServices component of Oracle Identity Manager, part of Oracle Fusion Middleware, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access can send HTTP requests to the REST endpoints without any credentials or user interaction. Successful exploitation results in takeover of Identity Manager, with high-impact confidentiality, integrity, and availability consequences (CVSS 3.1 base score 9.8). Any organization running the affected versions of Oracle Identity Manager — typically large enterprises and public-sector organizations using it for identity and access management — is exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-11-21, news reports describe it as an actively exploited zero-day, and EPSS assigns an 88.3% probability of exploitation within 30 days. Do: Immediately apply Oracle's fix for CVE-2025-61757 to Identity Manager 12.2.1.4.0 and 14.1.2.1.0 per Oracle's security advisory (federal agencies must follow BOD 22-01 timelines). Until patching is complete, restrict untrusted and internet-facing HTTP access to the Identity Manager REST WebServices endpoints, and review logs for signs of compromise given confirmed in-the-wild exploitation. Also verify that the separate unauthenticated RCE in Identity Manager (CVE-2026-21992), which Oracle has patched, is remediated in the same maintenance cycle. | 9.8 | 88% | KEV |
| largeon the order of tens of thousands of enterprise deployments worldwide; the share with the REST endpoint exposed over HTTP is unknown |
Full article486 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananNov 22, 2025Zero-Day / Software Security
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting Oracle Identity Manager to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerability in question is CVE-2025-61757 (CVSS score: 9.8), a case of missing authentication for a critical function that can result in pre-authenticated remote code execution. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0. It was addressed by Oracle as part of its quarterly updates released last month.
"Oracle Fusion Middleware contains a missing authentication for a critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager," CISA said.
Searchlight Cyber researchers Adam Kues and Shubham Shah, who discovered the flaw, said it can permit an attacker to access API endpoints that, in turn, can allow them "to manipulate authentication flows, escalate privileges, and move laterally across an organization's core systems."
Specifically, it stems from a bypass of a security filter that tricks protected endpoints into being treated as publicly accessible by simply adding "?WSDL" or ";.wadl" to any URI. This, in turn, is the result of a faulty allow-list mechanism based on regular expressions or string matching against the request URI.
"This system is very error-prone, and there are typically ways to trick these filters into thinking we're accessing an unauthenticated route when we're not," the researchers noted.
The authentication bypass can then be paired with a request to the "/iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus" endpoint to achieve remote code execution by sending a specially crafted HTTP POST. While the endpoint is only meant for checking the syntax of Groovy code and not executing it, Searchlight Cyber said it was able to "write a Groovy annotation that executes at compile time, even though the compiled code is not actually run."
The addition of CVE-2025-61757 to the KEV catalog comes days after Johannes B. Ullrich, the dean of research at the SANS Technology Institute, said an analysis of honeypot logs revealed several attempts to access the URL "/iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl" via HTTP POST requests between August 30 and September 9, 2025.
"There are several different IP addresses scanning for it, but they all use the same user agent, which suggests that we may be dealing with a single attacker," Ullrich said. "Sadly, we did not capture the bodies for these requests, but they were all POST requests. The content-length header indicated a 556-byte payload."
This indicates that the vulnerability may have been exploited as a zero-day vulnerability, well before a patch was shipped by Oracle. The IP addresses from which the attempts originated are listed below -
- 89.238.132[.]76
- 185.245.82[.]81
- 138.199.29[.]153
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary patches by December 12, 2025, to secure their networks.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/11/cisa-warns-of-actively-exploited.html