CVE-2025-61757: Oracle Identity Manager missing authentication in REST WebServices

CVE-2025-61757 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-10-21

Oracle Identity Manager, a tool used to manage user identities and access rights across an organization, contains a critical security flaw. An unauthorized person can remotely bypass security checks to take full control of the system. This could lead to the theft of sensitive user data, unauthorized access to other corporate systems, or a complete shutdown of identity services.

Technologies: Oracle Fusion Middleware. Vendors: Oracle.

Quick answers

Is CVE-2025-61757 exploited in the wild?
Yes. CVE-2025-61757 is known to be exploited in the wild, first recorded on 21 November 2025. Treat it as urgent.
How severe is CVE-2025-61757?
Critical severity, with a CVSS score of 9.8, published 21 October 2025.
Which products and versions are affected?
Oracle Identity Manager 12.2.1.4.0, 14.1.2.1.0.
Is there a fix for CVE-2025-61757?
A patch was published on 2025-10-21: Addressed in Oracle October 2025 Critical Patch Update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61757 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-61757?
Check whether you run Oracle Fusion Middleware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication for critical function vulnerability (CWE-306) exists in the REST WebServices component of Oracle Identity Manager. The flaw allows a remote, unauthenticated attacker to send specially crafted HTTP requests to the affected service. Because the component fails to properly verify the identity of the requester before performing sensitive operations, an attacker can achieve a complete takeover of the Identity Manager instance. This vulnerability is reportedly being exploited in the wild. Oracle has addressed this issue in the October 2025 Critical Patch Update.

Affected products

  • Oracle Identity Manager 12.2.1.4.0, 14.1.2.1.0

Timeline

  • 2025-10-21: disclosed: Initial CVE publication by Oracle
  • 2025-10-21: patched: Addressed in Oracle October 2025 Critical Patch Update
  • 2025-11-21: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2025-11-21: exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.