Paper/Archive/CVE-2025-61757

CVE-2025-61757

Oracle Corporation Identity Manager — Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

KEV · due 12 Dec EPSS 89%public exploit SSVC act CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 99.8.998 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

ProductAffectedFixed inSource

Identity Manager12.2.1.4.0–CNA

Identity Manager14.1.2.1.0–CNA

Scores by source

oracle (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisoryoracle.com/security-alerts/cpuoct2025.html refisc.sans.edu/diary/rss/32506 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757 kevcisa.gov/known-exploited-vulnerabilities-catalog