IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle Identity Manager: Missing authentication enables remote code execution

CVE-2025-61757Critical 9.8Actively exploitedPublic exploit

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 21 Nov 2025
Deadline for US federal agencies: 12 Dec 2025

Summary

Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Oracle Fusion Middleware, REST WebServices component) contain a missing authentication flaw (CWE-306). An unauthenticated attacker with HTTP access to the server can compromise the product and take it over, with a CVSS score of 9.8. Public proof-of-concept code exists, and CISA lists the flaw as known exploited since 21 November 2025, although early scans observed by SANS were later attributed to the researchers' own activity.

Affected

  • Oracle Identity Manager 12.2.1.4.0
  • Oracle Identity Manager 14.1.2.1.0

Fixed in

  • Patch included in Oracle's October 2025 Critical Patch Update (released 21 October 2025)
  • Patched build numbers: Unknown.

Workaround

  • Restrict network access to Oracle Identity Manager REST WebServices to trusted internal networks only.
  • Perimeter controls such as a WAF can limit exposure, but are not a substitute for patching. No vendor-validated WAF signature is known.

Exploitation

  • CISA KEV: listed as known exploited on 21 November 2025; federal remediation due date 12 December 2025.
  • Public PoC: yes, published by Searchlight Cyber, which discovered and reported the issue to Oracle.
  • Attack requires no credentials and no user interaction; the flaw is reachable over HTTP.
  • SANS observed POST requests to a URL ending in ';.wadl' between 30 August and 9 September 2025; SANS later reported these may originate from the researchers' own research activity, so they are treated as unconfirmed attacks.
  • Oracle has not confirmed exploitation in its bulletin.

Our recommendation

  • If the product is in use, confirm that the October 2025 CPU or a later release is applied.
  • Check whether the REST WebServices endpoints are reachable from the internet and remove that exposure.
  • Review web server logs for requests to URLs ending in ';.wadl' or other unusual POST requests, especially from August to October 2025.
  • Treat any instance that was exposed in that period as potentially compromised and investigate it.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:56.

Original description (NVD)

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Required action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed