What is the CVSS score of CVE-2025-61757?

CVE-2025-61757 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 88.6%.

Which versions of Oracle Identity Manager are affected by CVE-2025-61757?

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable to a critical remote takeover due to missing authentication in the REST WebServices interface, and this flaw is confirmed…

Is there a public PoC exploit available for CVE-2025-61757?

Yes, a public proof-of-concept exploit is available for CVE-2025-61757. Prioritise patching immediately. EPSS: 88.6%.

How to fix or mitigate CVE-2025-61757?

Within 24 hours, identify all instances of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 and restrict network access to the REST WebServices interface using firewall rules or segmentation; if the interface is not required, disable it immediately; enable verbose logging and monitor for exploitation attempts. Within 7 days, implement a reverse proxy or web application firewall with authentication enforcement in front of the REST WebServices, review and rotate any credentials that may have been exposed, and conduct a compromise assessment. Within 30 days, continue monitoring, apply the vendor patch as soon as it is released, and consider migrating to a supported version if available; review identity management architecture for similar missing authentication issues.

Oracle Identity Manager CVE-2025-61757

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2025-10-21 secalert_us@oracle.com

Authentication Bypass Oracle Identity Manager

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Missing authentication (CWE-306) on a network REST service gives AV:N/AC:L/PR:N/UI:N, and described full takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 15:52 vuln.today

Added to CISA KEV

Oct 08, 2026 - 11:31 CISA

CVE Published

Oct 21, 2025 - 20:20 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Unauthenticated remote takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible through the REST WebServices interface due to missing authentication (CWE-306). Exploitation is confirmed actively exploited (CISA KEV), with an EPSS score of 88.65% (100th percentile), and no privileges or user interaction are required. Any network-reachable affected deployment should be treated as critically exposed and prioritized for immediate mitigation.

Technical ContextAI

The affected component is the REST WebServices interface of Oracle Identity Manager within Oracle Fusion Middleware. CWE-306 (Missing Authentication for Critical Function) indicates that the REST endpoint fails to enforce authentication before exposing privileged operations, allowing an attacker with HTTP network reachability to invoke functionality as a high-privilege user. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms remote, low-complexity, unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact. The provided CPE strings identify Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 as the listed affected versions, and the assessment notes that no non-default feature or user action is required beyond network access to the REST endpoint.

RemediationAI

Apply the Oracle Critical Patch Update for October 2025 per the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2025.html; the input does not specify an exact fixed build, so treat the CPU as the vendor patch path and confirm the fixed Identity Manager bundle/version with Oracle. Because this CVE is in CISA KEV as confirmed actively exploited (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757), prioritize patching or isolation immediately. If patching cannot be completed at once, reduce exposure by blocking untrusted access to the Identity Manager HTTP/REST endpoints using network segmentation, firewall ACLs, or an authenticating reverse proxy/WAF that denies the affected REST paths, and monitor for anomalous REST authentication-bypass activity; these compensating controls may disrupt legitimate identity integrations, so validate required exception paths.