CVE-2025-61757
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Description
CVE-2025-61757 is a critical unauthenticated remote code execution vulnerability in Oracle Identity Manager, a component of Oracle Fusion Middleware used for identity governance and administration in enterprise environments. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0 through the REST WebServices component, allowing an unauthenticated attacker with network access via HTTP to completely take over the Identity Manager system. With a maximum CVSS v3.1 base score of 9.8, this vulnerability requires no privileges, no user interaction, and has low attack complexity. CISA has added CVE-2025-61757 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 12, 2025, and the EPSS score of 82.82% at the 99.2nd percentile indicates near-certain exploitation, placing it among the most actively exploited enterprise software vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | identity manager | 12.2.1.4.0; 14.1.2.1.0 |
References
- https://www.oracle.com/security-alerts/cpuoct2025.html(Vendor Advisory)
- https://isc.sans.edu/diary/rss/32506(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CVE-2025-61757 is classified under CWE-306 (Missing Authentication for Critical Function), a severe weakness that occurs when an application exposes critical functionality without requiring authentication to verify the identity of the requesting party. In Oracle Identity Manager, the REST WebServices component provides API endpoints for identity management operations. The vulnerable endpoints fail to enforce authentication, allowing any network-accessible attacker to invoke critical identity management functions that should be restricted to authorized administrators. Given that Identity Manager is specifically designed to control user identities and access across the enterprise, an authentication bypass in its own management interface represents a fundamental security architecture failure. Learn more about CWE-306
Impact Analysis
CVE-2025-61757 poses catastrophic risk to enterprise security because Oracle Identity Manager is the central authority for identity governance across the organization. Confidentiality is fully compromised as an attacker who takes over Identity Manager gains access to the complete user directory, including all identity attributes, group memberships, role assignments, entitlements, access policies, and potentially credential data or authentication secrets managed by the platform.
Integrity faces maximum impact because Identity Manager takeover enables the attacker to create new accounts with arbitrary privileges, modify existing user roles and entitlements, approve or deny access requests, change access policies, and effectively control who has access to what across every connected system in the enterprise. This is not merely application compromise; it is compromise of the trust fabric that governs access to all other systems.
Availability is critically threatened as the attacker can disable identity management services, lock out legitimate administrators, revoke user access across connected systems, or destroy the identity repository. The EPSS score of 82.82% at the 99.2nd percentile means this vulnerability is more likely to be exploited than 99.2% of all tracked vulnerabilities. The SANS Internet Storm Center has published an analysis tracking exploitation activity. While the ransomware association is currently classified as unknown, the strategic value of identity infrastructure compromise makes this an exceptionally high-priority target for both financially motivated groups and nation-state actors.
Exploit Maturity
CVE-2025-61757 exhibits near-maximum exploit maturity. The EPSS score of 82.82% at the 99.2nd percentile places it in the top 1% of all vulnerabilities for exploitation probability, indicating widespread active exploitation campaigns. CISA has confirmed active exploitation through KEV catalog inclusion.
Oracle disclosed the vulnerability in the October 2025 Critical Patch Update, providing the official vendor advisory and patch information. The SANS Internet Storm Center published a diary entry tracking exploitation activity against Oracle Identity Manager, confirming that threat actors are actively scanning for and exploiting vulnerable instances. The pre-authentication nature of the vulnerability combined with the low attack complexity means exploitation can be fully automated, enabling mass scanning and exploitation campaigns. The ransomware association is classified as unknown, but the strategic value of an identity management platform, which controls access to all enterprise resources, makes this an exceptionally attractive target for attackers seeking maximum leverage within an organization.
Remediation
-
Apply the Oracle Critical Patch Update immediately. Oracle has released patches for both affected versions (12.2.1.4.0 and 14.1.2.1.0) in the October 2025 CPU. Given the critical severity and confirmed active exploitation, this patch should be treated as an emergency deployment with the highest priority.
-
Restrict network access to Oracle Identity Manager REST WebServices endpoints immediately as a compensating control. Implement firewall rules or reverse proxy configurations to block unauthenticated access to the Identity Manager web services from all untrusted networks. Only authorized management workstations and application integration endpoints should be able to reach these services.
-
Conduct a thorough audit of the Identity Manager deployment for signs of compromise. Review all user accounts, particularly recently created accounts, accounts with elevated privileges, and any accounts modified after the vulnerability became publicly known. Check access logs for unusual REST API calls, especially from unexpected source IP addresses.
-
Review all identity changes made through the Identity Manager platform during the exposure window. Any user provisioning, role assignments, entitlement changes, or access policy modifications that cannot be attributed to legitimate administrator activity should be investigated and potentially reverted.
-
Implement defense-in-depth controls including web application firewall rules to detect and block exploitation attempts targeting Identity Manager REST endpoints, network-level monitoring for anomalous traffic patterns to the Identity Manager server, and enhanced logging to capture all API interactions for forensic analysis.
Technical Details
CVE-2025-61757 is a missing authentication vulnerability in Oracle Identity Manager's REST WebServices component. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, producing a base score of 9.8.
The vector analysis reveals the maximum possible impact for an unchanged-scope vulnerability. Attack Vector (AV:N) confirms remote exploitation over the network via HTTP. Attack Complexity (AC:L) indicates that exploitation is straightforward and reliable. Privileges Required (PR:N) is the critical factor, confirming that no authentication whatsoever is required to exploit the vulnerability. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:U) indicates the impact is assessed within the Identity Manager component boundary, though in practice the compromise of an identity governance platform has cascading effects across the entire enterprise.
The vulnerability exists in the REST WebServices component of Oracle Identity Manager. This component exposes API endpoints for managing user identities, roles, entitlements, and access policies through RESTful HTTP calls. In the affected versions 12.2.1.4.0 and 14.1.2.1.0, certain critical REST endpoints do not enforce authentication checks before processing requests. An unauthenticated attacker can send crafted HTTP requests to these endpoints to invoke identity management operations that should be restricted to authenticated administrators. Oracle describes the successful exploitation result as "takeover of Identity Manager," indicating the attacker gains full administrative control over the identity management platform and all identities it governs.
Frequently Asked Questions
What is CVE-2025-61757?
CVE-2025-61757 is a critical unauthenticated access vulnerability in Oracle Identity Manager, a component of Oracle Fusion Middleware. It allows remote attackers without any credentials to take over the Identity Manager system through its REST WebServices API.
Why is Oracle Identity Manager compromise so severe?
Oracle Identity Manager is the central identity governance platform that controls user accounts, roles, and access across the enterprise. Compromising it gives attackers the ability to create, modify, or delete any user account, assign arbitrary privileges, and effectively control access to every connected system in the organization.
Which versions are affected?
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are confirmed as affected. The fix is available in Oracle's October 2025 Critical Patch Update.
Can this vulnerability be exploited without any credentials?
Yes. The vulnerability has a Privileges Required rating of None (PR:N), meaning an unauthenticated attacker with only network access to the Identity Manager HTTP interface can fully exploit the vulnerability and take over the system.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.