Actively exploited · Published Oct 21, 2025 · Assigned by oracle
CVE-2025-61757
Critical 9.8 Exploited
In plain English
A critical-severity missing authentication in Identity Manager from Oracle Corporation. Attackers are actively exploiting it in the wild (listed by CISA on November 21, 2025). The chance it is exploited in the next 30 days is estimated at 88.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 12, 2025.
Official description
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Oracle Corporation | Identity Manager | 12.2.1.4.014.1.2.1.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Oracle Advisory vendor-advisory
- https://isc.sans.edu/diary/rss/32506 media-coverage
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757 government-resource