ZeroDay Findings
Sign inSign up

Findings

CVE-2025-61757

Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

Published Oct 21, 2025 · updated Oct 8, 2026 · Oracle Fusion Middleware

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2025 · Catalog

    Detected

    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Sc

  2. Nov 21, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Dec 12, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Oct 8, 2026 · Catalog

    Updated

    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Sc

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Dec 12, 2025

Affected

  • cpe oracle/identity manager12.2.1.4.0
  • cpe oracle/identity manager14.1.2.1.0
  • vendor Oracle Fusion Middlewareversion unspecified

Sources

  • CISA KEVCVE-2025-61757

    Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.

    cisa.gov
  • CVE.orgCVE-2025-61757

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-61757

    30-day exploitation probability 88.6%

    first.org
  • NIST NVDCVE-2025-61757

    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi

    nvd.nist.gov

References

CVE-2025-61757 · ZeroDay Findings