Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning regarding CVE-2025-61757, a remote code execution (RCE) vulnerability in Oracle Fusion Middleware Identity Manager. The flaw, rated 9.8 out of 10.0 on the CVSS scale, is being actively exploited in the wild, leading to its addition to CISA's Known Exploited Vulnerabilities (KEV) catalog. The vulnerability allows a remote, unauthenticated attacker to completely compromise affected systems. It impacts Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. Due to the confirmed exploitation and severe risk, CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies must apply Oracle's patch, released in October 2025, by December 12, 2025. All organizations using the affected software are urged to patch immediately.

Vulnerability Details

The vulnerability, CVE-2025-61757, is a combination of two distinct issues that can be chained together to achieve pre-authentication RCE.

1. Authentication Bypass: The root cause is a "missing authentication for critical function" flaw. Researchers at Searchlight Cyber discovered that a security filter in Oracle Identity Manager could be tricked into treating protected REST API endpoints as public. An attacker can achieve this simply by appending a specific parameter, such as ?WSDL or ;.wadl, to the URL path of a protected resource. This bypasses the authentication check entirely.

2. Code Injection: Once authentication is bypassed, the attacker can send a request to a normally protected Groovy script endpoint. This endpoint was intended for benign purposes like syntax checking. However, it is vulnerable to code injection through Groovy's annotation-processing features. An attacker can craft a malicious script that is executed at compile time on the server, leading to arbitrary code execution.

The combination of these two flaws makes the exploit "somewhat trivial," according to researchers, as it does not require any credentials or user interaction.

Exploitation Status

CISA has confirmed active exploitation of CVE-2025-61757. This is corroborated by researchers at the SANS Technology Institute, who observed multiple HTTP POST requests targeting the vulnerable endpoint between August 30 and September 9, 2025. These attempts occurred weeks before Oracle released a patch on October 21, 2025, indicating the vulnerability was exploited as a zero-day. The scans originated from multiple IP addresses but shared a common user agent, suggesting a single threat actor was likely behind the initial exploitation campaign. The addition of the flaw to the KEV catalog underscores the immediate and ongoing threat.

Affected Systems

• Oracle Fusion Middleware Identity Manager, version 12.2.1.4.0
• Oracle Fusion Middleware Identity Manager, version 14.1.2.1.0

Organizations using these specific versions are highly vulnerable and should prioritize remediation.

Impact Assessment

A successful exploit of CVE-2025-61757 grants an attacker complete control over the underlying Oracle Identity Manager server. As an identity and access management (IAM) solution, this system is a high-value target. A compromise could lead to:

• Creation of rogue administrator accounts.
• Modification or theft of all user credentials managed by the system.
• Lateral movement into other integrated enterprise applications.
• Complete loss of confidentiality, integrity, and availability of the IAM infrastructure.

For government agencies and large enterprises that rely on this product, a compromise could be catastrophic, enabling widespread unauthorized access across the organization's entire IT landscape.

IOCs

Cyber Observables for Detection

Detection Methods

Security teams should focus on both network and host-based detection.

1. Web Log Analysis: Ingest web server, reverse proxy, and WAF logs into a SIEM. Create detection rules to alert on requests to Oracle Identity Manager paths that contain the ?WSDL or ;.wadl strings, especially if followed by a POST request to a script endpoint. This is a direct application of D3-NTA: Network Traffic Analysis.

2. EDR Monitoring: On the Oracle server, monitor the Java process associated with WebLogic Server for any suspicious child process creation. The application should not be spawning shells or command-line interpreters. This falls under D3-PA: Process Analysis.

3. Vulnerability Scanning: Use authenticated vulnerability scanners to check for the presence of vulnerable Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0.

Remediation Steps

The primary remediation is to apply the security updates released by Oracle in its October 2025 Critical Patch Update (CPU).

1. Patch Immediately: Prioritize the deployment of the patch for CVE-2025-61757 on all internet-facing and internal Oracle Identity Manager instances. This is a form of D3-SU: Software Update.

2. Workaround (Temporary): If patching is not immediately possible, implement strict access control rules on a WAF or reverse proxy to block any requests containing the patterns ?WSDL or ;.wadl directed at the Oracle Identity Manager application. This is a compensating control but should not replace patching. This is a form of D3-ITF: Inbound Traffic Filtering.

3. Assume Compromise: Given the evidence of zero-day exploitation, organizations with vulnerable, internet-exposed systems should assume compromise and initiate threat hunting activities to look for signs of persistence or lateral movement.