# CVE-2025-61757: Oracle Identity Manager - Authentication Bypass

> Live exploitation tracking for CVE-2025-61757 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-61757

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Oracle Identity Manager
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** enterprise_software

## Description

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager.  Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

## CrowdSec analysis

[CVE-2025-61757](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-61757) is a critical vulnerability in Oracle Fusion Middleware's Identity Manager REST WebServices component, affecting versions 12.2.1.4.0 and 14.1.2.1.0. This flaw allows unauthenticated attackers with network access via HTTP to easily compromise the Identity Manager, potentially resulting in a complete system takeover. Exploitation could lead to severe impacts on confidentiality, integrity, and availability, making it a prime target for remote attacks.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-61757 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending unauthenticated requests to endpoints such as `/iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus` and `/iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl`, bypassing authentication to gain unauthorized access and potentially take over Oracle Identity Manager.

## Timeline

- 2025-10-21: CVE Published. CVE-2025-61757 is published to NVD.
- 2025-11-21: CISA KEV. CVE-2025-61757 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-12-10: Rule Released. CrowdSec releases a rule to detect CVE-2025-61757 exploitation attempts against the CrowdSec Network.
- 2025-12-12: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-12-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-61757 for the first time.

## References

- https://www.oracle.com/security-alerts/cpuoct2025.html
- https://isc.sans.edu/diary/rss/32506
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61757.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-61757) follows observed exploitation activity for CVE-2025-61757. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.