Introduction
A single unauthenticated HTTP request can fully compromise an Oracle Identity Manager deployment running some of the most widely used versions in enterprise environments. CVE-2025-61757, disclosed in Oracle's October 2025 Critical Patch Update, lets remote attackers take over affected systems. Organizations that have not yet applied the fix have their identity governance and access management at risk.
Oracle Identity Manager is a central component of Oracle's enterprise identity and access management suite. Large organizations worldwide use it to automate user provisioning, enforce access policies, and maintain audit trails. It runs in complex environments and often integrates with critical business systems.
Technical Information
CVE-2025-61757 is a vulnerability in the REST WebServices component of Oracle Identity Manager, which is part of the Fusion Middleware platform. The flaw is present in versions 12.2.1.4.0 and 14.1.2.1.0. According to Oracle's advisory and CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability:
- Is exploitable remotely over a network using HTTP
- Requires no authentication or user interaction
- Has low attack complexity
- Results in full compromise of confidentiality, integrity, and availability
Oracle has not published further technical details, a root cause analysis, or code snippets for this vulnerability. No public exploit or proof of concept was available as of the advisory date. The vulnerability is considered easily exploitable, and a successful attack can lead to complete takeover of the Oracle Identity Manager instance.
Affected Systems and Versions
- Oracle Identity Manager 12.2.1.4.0
- Oracle Identity Manager 14.1.2.1.0
Only these two versions are listed as affected. The flaw is in the REST WebServices component, and every configuration of these versions is at risk if the REST API is accessible over the network.
Vendor Security History
Oracle has a history of critical vulnerabilities in its identity management products. CVE-2017-10151, for example, affected Oracle Identity Manager and allowed unauthenticated remote compromise through a default account. Oracle typically fixes issues like these in its quarterly Critical Patch Update cycle and publishes detailed patching instructions. The company has a large portfolio of enterprise software and generally responds to severe vulnerabilities, but its products are complex enough that security teams need to keep watching for new advisories.
