CVE-2025-61757: Oracle Identity Manager REST WebServices missing authentication allows takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated network-reachable takeover of an identity management system, listed in CISA KEV with very high EPSS probability.

What it is

Oracle Fusion Middleware Identity Manager exposes a REST WebServices component that fails to require authentication for a critical function (CWE-306). An unauthenticated attacker with network access can reach it over HTTP and fully compromise the product, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0.

Impact

Successful exploitation results in complete takeover of Identity Manager, with high confidentiality, integrity and availability impact, giving the attacker control over an identity and access management system.

Attack surface

Reachable over the network via HTTP against the REST WebServices component; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-11-21 with a remediation due date of 2025-12-12, and EPSS gives a 30-day exploitation probability of 0.883 (99.8th percentile), indicating active exploitation is expected or observed. No ransomware campaign use is documented.

What to do

• Apply the Oracle October 2025 Critical Patch Update for Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) as the primary fix.
• If patching cannot be completed by the CISA due date, restrict network access to the Identity Manager REST WebServices endpoint to trusted hosts only.
• Follow CISA BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
• Review and rotate credentials and secrets held by Identity Manager in case of prior compromise.

Detection

• Monitor HTTP access logs for unauthenticated requests to Identity Manager REST WebServices endpoints, especially from unexpected source IPs.
• Alert on anomalous administrative or configuration changes within Identity Manager outside normal change windows.
• Hunt for new or modified accounts, tokens or policy changes in Identity Manager that were not initiated by known administrators.
• Correlate network connections to the Identity Manager REST interface with post-exploitation activity such as outbound callbacks or credential access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.