Oracle Identity Manager Vulnerability CVE-2025-61757: A Critical Security Threat

Recent warnings from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) have highlighted the urgent need for government agencies to patch a critical vulnerability in Oracle Identity Manager. Tracked as CVE-2025-61757, this vulnerability has been actively exploited in attacks, potentially as a zero-day threat.

Discovered by Searchlight Cyber analysts Adam Kues and Shubham Shahflaw, CVE-2025-61757 is a pre-authentication remote code execution (RCE) vulnerability in Oracle Identity Manager. The flaw originates from an authentication bypass in the application’s REST APIs, allowing attackers to manipulate security filters and gain unauthorized access to protected endpoints.

Once access is obtained, threat actors can exploit a Groovy script to execute malicious code, leveraging Groovy’s annotation-processing features. This series of vulnerabilities enabled researchers to achieve pre-authentication remote code execution on affected Oracle Identity Manager instances.

Oracle addressed the CVE-2025-61757 vulnerability as part of its October 2025 security updates, released on October 21. Despite the patch availability, Searchlight Cyber recently published a detailed technical report outlining the flaw and providing insights into its exploitation.

Exploitation and Response

CISA has classified the Oracle CVE-2025-61757 vulnerability as a Known Exploited Vulnerability (KEV) and mandated Federal Civilian Executive Branch (FCEB) agencies to patch it by December 12. This directive, outlined in Binding Operational Directive (BOD) 22-01, aims to mitigate the risks posed by such vulnerabilities to the federal enterprise.

While specifics of the attacks remain undisclosed by CISA, Johannes Ullrich from SANS Technology Institute raised concerns about potential zero-day exploitation as early as August 30. Ullrich noted suspicious activities targeting specific endpoints corresponding to the exploit shared by Searchlight Cyber.

      /iam/governance/applicationmanagement/templates;.wadl

      /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl

   

Multiple IP addresses were flagged for scanning these endpoints, signaling a coordinated attack. Notably, all requests shared a common user agent associated with Google Chrome 60 on Windows 10.

Oracle has yet to confirm any active exploits of the vulnerability. BleepingComputer reached out to Oracle for comment on this matter.

As the Model Context Protocol (MCP) gains prominence in connecting LLMs to tools and data, security measures are crucial to safeguard these services. Download our free cheat sheet outlining 7 best practices for enhanced security.

Download Now