CVE-2025-61757criticalunder attackCWE-306

CVE-2025-61757: critical vulnerability in Oracle Corporation Identity Manager

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 89%
from disclosure to weapon30 days
Published on NVDOct 21
1st PoC+30d
CISA KEV+31d
exploitation probability
89%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
3 public exploit(s)
Action required by CISAfederal deadline: 2025-12-12

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Oracle Identity Manager has a critical flaw in its REST web services that allows attackers to take over the system without needing a password or login credentials. An attacker on the network can exploit this to gain complete control over user identities and access.

Technical detail

An unauthenticated remote code execution vulnerability exists in Oracle Identity Manager's REST WebServices component (versions 12.2.1.4.0 and 14.1.2.1.0) requiring only network access via HTTP with no authentication or user interaction. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Identity Manager system.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Oracle Corporation · Identity Manager
public PoCs found — 3
githubgithub.com/Jinxia62/Oracle-Identity-Manager-CVE-2025-61757★ 4githubgithub.com/ngominhquocngu/Blackash-CVE-2025-61757★ 0vulncheckvulncheck.com/xdb/35d1c2c721d1unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Oracle Corporation Identity Manager

In the same product, most dangerous first.

CVE-2017-10151—CVE-2017-10151EPSS 3.9%CVE-2017-3553—CVE-2017-3553EPSS 2.4%CVE-2020-2728HIGHCVE-2020-2728EPSS 2.0%CVE-2018-3179—CVE-2018-3179EPSS 1.8%CVE-2021-2457MEDIUMCVE-2021-2457EPSS 1.2%CVE-2019-2858—CVE-2019-2858EPSS 0.9%
References
https://isc.sans.edu/diary/rss/32506https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757https://www.oracle.com/security-alerts/cpuoct2025.html