CVE-2025-61757

Published Oct 21, 2025

Last updated 2 months ago

Oracle Identity Manager

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-61757 is a vulnerability in the Identity Manager product of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.1.0. The affected component is REST WebServices. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the Identity Manager. Successful attacks can result in a takeover of the Identity Manager. The vulnerability is classified under CWE-306, which indicates missing or insufficient authentication controls.

Description: Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Source: secalert_us@oracle.com
NVD status: Analyzed
Products: identity_manager

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Exploit added on: Nov 21, 2025
Exploit action due: Dec 12, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "95593D6C-8396-4AF5-BA79-8DB8EDA9FC5B"
          },
          {
            "criteria": "cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FA634664-8CC5-4017-A445-A23E205BEEC2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.