WaratekVRT Sign in

CVE-2025-61757 Oracle Identity Manager

Affected softwareOracle Identity Manager
Affected versions12.2.1.4.0, 14.1.2.1.0
Severity9.8 Critical CVSS 3.1
Fixed inOracle Critical Patch Update October 2025
WeaknessMissing authentication (CWE-306)
Published21 Oct 2025
Updated8 Oct 2026

Description

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2025-11-21 · remediation due 2025-12-12 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 9 citations · honeypot sightings · 1 exploit · earliest 2025-11-20.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2025-11-21.
  • EPSS 89% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2025-61757 in VulnCheck (free account), which lists 4 more citations not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 1 day 2025-12-03
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 6 days 2026-05-05 to 2026-11-06
Reported exploitation isc.sans.edu /diary/rss/32506 2025-11-20
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2025-11-21
Reported exploitation imperva.com /blog/cve-2025-61757-imperva-customers-protected-against-critical-oracle-identity-manager-authentication-bypass-leading-to-remote-code-execution 2025-12-01
Reported exploitation recordedfuture.com /blog/november-2025-cve-landscape 2025-12-09
Reported exploitation cyble.com /resources/research-reports/global-cybersecurity-report 2025-12-11
Exploit reference VulnCheck XDB 35d1c2c721d1 Exploit type: remote-with-credentials 2025-12-01

2 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Oracle Identity Manager 远程代码执行漏洞CVE-2025-61757 4 2025-11-21
GitHub PoC CVE-2025-61757 2025-11-25
Nuclei Oracle Identity Manager REST WebServices - Authentication Bypass

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Process rule, ARMR Filesystem Write, ARMR Filesystem Read.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Process rule, ARMR Filesystem Write, ARMR Filesystem Read

Pre-auth Groovy script injection in Oracle Identity Manager (;.wadl suffix skips the URL filter); the Process rule (with /bin/* and /usr/* listed) blocks the Runtime.exec behind Groovy String.execute(), and filesystem rules on the OIM paths cover a script that works on files directly in Java.

How to mitigate CVE-2025-61757

Apply the fix in Oracle Critical Patch Update October 2025. Until you can, Waratek RASP blocks exploitation with its process and filesystem rules. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Security Patch Update August 2026 ↗ CSPU 2026-Q3 Oracle Fusion Middleware / OIM Legacy UI (12.2.1.4.0, 14.1.2.1.0)
Oracle Critical Patch Update October 2025 ↗ CPU 2025-Q4 Oracle Fusion Middleware / REST WebServices (12.2.1.4.0, 14.1.2.1.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware OIM Legacy UI 12.2.1.4.0, 14.1.2.1.0 12.2.1.4.0 · 14.1.2.1.0
Oracle Fusion Middleware REST WebServices 12.2.1.4.0, 14.1.2.1.0 12.2.1.4.0 · 14.1.2.1.0

Products and versions

1 product, 2 version entries
SourceVendorProductSchemeAffected versions
nvd oracle identity manager generic 12.2.1.4.0 · 14.1.2.1.0

References

URLTags
https://www.oracle.com/security-alerts/cpuoct2025.html
https://isc.sans.edu/diary/rss/32506 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757 US Government Resource

Timeline
Published2025-10-21By the CVE Program.
VulnCheck KEV: earliest evidence2025-11-20Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2025-11-21Listed in CISA's Known Exploited Vulnerabilities catalog.
Last VRT activity2026-09-30Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-10-08NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-06Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.