CVE DatabaseCVE-2025-61757

Updated 2026-10-08한국어 권고문 →

CVE-2025-617579.8/CRITICALCISA KEVCWE-306

Oracle Identity Manager REST WebServices Authentication Bypass and System Takeover Vulnerability (CVE-2025-61757) Urgent Security Advisory

⚡ Jump to Patch

Affected Vendors

oracle

Affected Components

identity manager

Published Date

2025-10-21

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

88.6%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Oracle Fusion Middleware Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 (REST WebServices component)

Impact

Unauthenticated remote attackers can bypass authentication via HTTP network access to achieve complete takeover of the Identity Manager system

Mitigation

Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external access to REST API endpoints

Affected Products & Version Scope

Oracle Fusion Middleware Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Download the official Oracle Critical Patch Update (CPU) and apply the patch using the OPatch utility.

bash

# Set environment variables and verify OPatch version
export ORACLE_HOME='/u01/app/oracle/middleware/idm'
export PATH=$ORACLE_HOME/OPatch:$PATH
opatch version

# Apply the downloaded Oracle CPU patch (execute from patch directory)
cd /u01/patches/55555555
opatch apply -silent

2. Temporary Workaround & Hardening Configuration

Before applying the patch, restrict external access to the Identity Manager REST WebServices API endpoints ('/iam/governance/selfservice/api', '/oim/rest') using a WAF or Reverse Proxy.

nginx

# Example Nginx configuration to block external access to REST APIs
server {
    listen 80;
    server_name oim.internal.local;

    # Block external access to REST WebServices API paths
    location ~* ^/(iam/governance/selfservice/api|oim/rest) {
        allow 10.0.0.0/8;
        allow 192.168.0.0/16;
        deny all;
        
        proxy_pass http://oim_backend_servers;
        proxy_set_header Host $host;
    }
}

3. Log Audit & IoC Verification Commands

Use the following command to inspect Identity Manager access logs for unauthorized or suspicious REST API calls.

bash

# Scan OIM access logs for REST API requests returning 200 OK from external IPs
grep -E '/iam/governance/selfservice/api/|/oim/rest/' /u01/app/oracle/config/domains/oim_domain/servers/oim_server1/logs/access.log | grep ' 200 ' | awk '{print $1, $4, $6, $7, $9}'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

As this vulnerability is actively exploited in the wild (CISA KEV), immediately apply the Oracle CPU patch and restrict public access to REST API endpoints.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-61757) exists in the REST WebServices component of Oracle Fusion Middleware Identity Manager. It is caused by a missing authentication mechanism for critical functions (CWE-306), allowing unauthenticated remote attackers to access sensitive API endpoints without providing valid credentials.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the Identity Manager's REST WebServices port. Because the application fails to enforce proper authentication checks on these endpoints, the attacker can bypass security controls and execute administrative API functions directly. Since this vulnerability is listed in the CISA KEV catalog, active exploitation in the wild has been confirmed, and automated scanning/exploitation attempts are highly likely.

3. Infrastructure & Business Impact

Identity Manager serves as the central Identity and Access Management (IAM) hub for enterprise user accounts, roles, and authentication policies. Successful exploitation of this vulnerability leads to a complete takeover of the Identity Manager system. This can result in enterprise-wide credential theft, privilege escalation, lateral movement within the internal network, and massive data breaches.

Official Vendor Advisories & References

NVD Original English Description

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

https://www.oracle.com/security-alerts/cpuoct2025.html

Source: secalert_us@oracle.com · Vendor Advisory

https://isc.sans.edu/diary/rss/32506

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2025-61757)

FAQ

Q1. How critical is CVE-2025-61757 and is it actively exploited in the wild?

CVE-2025-61757 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 88.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-61757?

Primary impacted vendors include oracle across identity manager. Scope summary: Oracle Fusion Middleware Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0

Q3. What temporary mitigations or workarounds exist for CVE-2025-61757 before patching?

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external access to REST API endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION