CVE-2025-61757

What it actually does

CVE-2025-61757 is an unauthenticated, network-exploitable vulnerability in the REST WebServices component of Oracle Identity Manager within Oracle Fusion Middleware. Because a critical function is reachable over HTTP without proper authentication, an attacker can interact with privileged Identity Manager functionality without valid credentials. Successful exploitation can result in full compromise of Identity Manager, including confidentiality, integrity, and availability impact: unauthorized access to identity data, modification of identities, roles, entitlements, or workflows, and disruption of identity services.

Why it matters to the business

This is a critical identity-platform takeover risk. Oracle Identity Manager commonly controls user provisioning, access governance, role assignments, and integration with downstream business applications, so compromise can allow attackers to create or alter accounts, expand access, disrupt authentication or provisioning, and undermine trust in enterprise identity controls. The vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score, making remediation urgent; CISA’s KEV due date is 2025-12-12. Although the provided KEV metadata does not indicate ransomware use, identity-system compromise is a frequent precursor to broader intrusion, data theft, persistence, and lateral movement.

How an attack unfolds

An attacker first identifies an internet-facing or internally reachable Oracle Identity Manager instance exposing the affected REST WebServices component on HTTP or HTTPS. Because the vulnerable function does not enforce authentication correctly, the attacker sends crafted REST requests directly to the vulnerable endpoint without a valid session. If exploitation succeeds, the attacker gains control over Identity Manager functionality and can use that control to enumerate identity data, manipulate accounts or roles, create privileged access, disrupt services, or establish persistence through identity changes. Public exploitation is reported as active in the wild, with source metadata referencing Oracle Identity Manager exploitation activity, Oracle Fusion Middleware missing-authentication exploitation, and the LANDFALL Android spyware campaign context; defenders should treat any exposed affected instance as a high-priority compromise candidate rather than only a patching issue.

How to fix it

Upgrade Oracle Identity Manager / Oracle Fusion Middleware to a vendor-fixed release or apply the relevant Oracle Critical Patch Update addressing CVE-2025-61757. The affected supported versions identified are 12.2.1.4.0 and 14.1.2.1.0; no exact fixed build numbers were provided in the input, so administrators should use Oracle’s advisory and patch matrix for the applicable platform, bundle patch, and middleware home. Until patched, restrict network access to Oracle Identity Manager REST interfaces to trusted administrative and application networks, place the service behind strong access controls, disable unnecessary externally reachable REST WebServices where operationally possible, and enforce WAF/API gateway rules that block unauthenticated access to sensitive Identity Manager REST paths. Because the issue can lead to full takeover, remediation should also include credential, role, entitlement, and administrative-account review after patching, not only software upgrade.

How to confirm the fix worked

Confirm exposure by inventorying Oracle Identity Manager deployments and verifying whether any instance is running affected versions 12.2.1.4.0 or 14.1.2.1.0. Validate remediation by checking Oracle OPatch inventory, WebLogic/Fusion Middleware patch inventory, product version banners, and Oracle advisory compliance output to confirm the relevant security patch or fixed release is installed. From the network side, verify that REST WebServices are not reachable from untrusted networks and that unauthenticated requests to sensitive Identity Manager REST endpoints receive authentication or authorization failures rather than functional responses. After patching, review Identity Manager administrative users, role memberships, provisioning policies, connectors, approval workflows, and recent identity changes for unauthorized modifications.

Typical attack path

1. Discover Oracle Identity Manager or Oracle Fusion Middleware services exposed over HTTP/HTTPS.
2. Fingerprint the service version or REST WebServices behavior to identify affected Oracle Identity Manager versions 12.2.1.4.0 or 14.1.2.1.0.
3. Send unauthenticated crafted HTTP requests to vulnerable REST WebServices functionality.
4. Abuse successful access to perform privileged Identity Manager actions.
5. Enumerate identities, roles, entitlements, workflows, or connected systems.
6. Create or modify accounts, credentials, roles, approvals, or access policies to gain persistence or expand privileges.
7. Use the identity compromise to access downstream applications, move laterally, or disrupt provisioning and access-management operations.

How to detect it

Investigate exploitation using HTTP access logs from Oracle HTTP Server, WebLogic access logs, reverse proxies, WAFs, API gateways, and load balancers in front of Oracle Identity Manager, plus Oracle Identity Manager application and audit logs. Focus on unauthenticated or sessionless requests to Identity Manager REST WebServices, especially requests returning successful status codes and followed by identity-administration activity. Look for unusual spikes in REST API traffic, requests from unfamiliar IP addresses, malformed or automated user agents, authentication bypass patterns, and administrative actions without a corresponding legitimate login. In Oracle Identity Manager audit data, review creation or modification of users, privileged roles, entitlements, access policies, connectors, scheduled tasks, approval workflows, and password/credential changes. Because active exploitation is reported and KEV-listed, correlate suspicious HTTP activity with downstream signs such as new privileged accounts, unexpected provisioning events, service disruptions, or anomalous access to applications shortly after Identity Manager changes. Where threat-intelligence labels reference Oracle Identity Manager exploitation, Oracle Fusion Middleware missing-authentication exploitation, or LANDFALL-related activity, use those as context but prioritize product-specific telemetry over actor attribution.

• /iam/governance/
• /iam/admin/
• /iam/governance/selfservice/api/
• /iam/governance/adminservice/api/
• /identity/
• /oim/
• $DOMAIN_HOME/servers/oim_server*/logs/oim_server*.log
• $DOMAIN_HOME/servers/AdminServer/logs/AdminServer.log
• $DOMAIN_HOME/servers/*/logs/access.log
• $ORACLE_HOME/user_projects/domains/*/servers/*/logs/*.log
• Unauthenticated request to Identity Manager REST
• REST WebServices
• Oracle Identity Manager
• Oracle Fusion Middleware

What your security team should do

• Treat all affected internet-facing Oracle Identity Manager instances as urgent; patch or isolate immediately due to KEV listing, active exploitation, CVSS 9.8 severity, and high EPSS likelihood.
• Meet or beat the CISA KEV remediation deadline of 2025-12-12 for any applicable systems, and use a shorter internal SLA for externally exposed instances.
• Before and after patching, collect and preserve Oracle HTTP Server, WebLogic, Identity Manager, load balancer, WAF, and reverse-proxy logs for retrospective exploitation review.
• Temporarily restrict access to Oracle Identity Manager REST WebServices to trusted networks or VPN-only access until fixed.
• Hunt for unauthenticated HTTP requests to Identity Manager REST paths, especially requests that resulted in HTTP 200/201/204 responses or triggered administrative identity changes.
• Review recent account creations, administrative role grants, entitlement changes, access-policy edits, connector changes, workflow modifications, and password or credential resets.
• Rotate credentials and secrets associated with Oracle Identity Manager integrations if compromise is suspected.
• Add compensating monitoring for privileged Identity Manager actions and downstream application access originating after suspicious identity changes.