CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2025-61757Public Exploit

Oracle Identity Manager - Authentication Bypass (CVE-2025-61757)

PublishedOct 21, 2025
First SeenJan 15, 2026
Last Seen
Reported
CVSS9.8
Oracle
OracleIdentity Manager
enterprise_software

Description

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

psychologyCrowdSec Analysis

CVE-2025-61757 is a critical vulnerability in Oracle Fusion Middleware's Identity Manager REST WebServices component, affecting versions 12.2.1.4.0 and 14.1.2.1.0. This flaw allows unauthenticated attackers with network access via HTTP to easily compromise the Identity Manager, potentially resulting in a complete system takeover. Exploitation could lead to severe impacts on confidentiality, integrity, and availability, making it a prime target for remote attacks.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-61757 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending unauthenticated requests to endpoints such as /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus and /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl, bypassing authentication to gain unauthorized access and potentially take over Oracle Identity Manager.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2025-10-21
CISA KEV2025-11-21
Rule Released2025-12-10
CISA Remediation Deadline2025-12-12
CrowdSec First Seen2025-12-15

Related Weaknesses

CWE-306: Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References