When a vulnerability lands in the identity tier, the blast radius extends far beyond a single host. That is exactly the situation with ๐๐๐-๐๐๐๐-๐๐๐๐๐, a pre-authentication remote code execution flaw in ๐๐ซ๐๐๐ฅ๐ ๐๐๐๐ง๐ญ๐ข๐ญ๐ฒ ๐๐๐ง๐๐ ๐๐ซ (๐๐๐). The bug allows an unauthenticated attacker with network access to bypass REST API protections and execute arbitrary code on vulnerable servers. CISA has now added CVE-2025-61757 to its ๐๐ง๐จ๐ฐ๐ง ๐๐ฑ๐ฉ๐ฅ๐จ๐ข๐ญ๐๐ ๐๐ฎ๐ฅ๐ง๐๐ซ๐๐๐ข๐ฅ๐ข๐ญ๐ข๐๐ฌ (๐๐๐) catalog and set a short patch deadline for federal agencies, which signals that exploitation moved from theory into practice.
๐๐ก๐ฒ ๐๐๐-๐๐๐๐-๐๐๐๐๐ ๐ฆ๐๐ญ๐ญ๐๐ซ๐ฌ ๐๐จ๐ซ ๐ญ๐ก๐ ๐ข๐๐๐ง๐ญ๐ข๐ญ๐ฒ ๐ญ๐ข๐๐ซ
Oracle Identity Manager sits in the middle of account lifecycle management, approvals and provisioning flows across many enterprises. When an attacker gains remote code execution on that system before authentication, the compromise goes straight to the control plane that creates and manages identities. Researchers at Searchlight Cyber, who discovered the bug, emphasized that they treated it as a high-leverage identity-tier issue from day one, not just โanother Java vulnerability.โย
Because OIM often connects to HR systems, directories, cloud apps and privileged-role workflows, a successful exploit can quickly pivot into broad account abuse. Therefore, CVE-2025-61757 does not only represent server access; it represents the potential to create, modify or hijack identities at scale if organizations leave the flaw unpatched.
๐๐จ๐ฐ ๐ญ๐ก๐ ๐๐ซ๐๐๐ฅ๐ ๐๐๐๐ง๐ญ๐ข๐ญ๐ฒ ๐๐๐ง๐๐ ๐๐ซ ๐๐๐๐ ๐๐๐ ๐๐ฒ๐ฉ๐๐ฌ๐ฌ ๐ฐ๐จ๐ซ๐ค๐ฌ
The core of CVE-2025-61757 lies in how Oracle Identity Manager secures its REST endpoints. A security filter should block unauthenticated requests from reaching sensitive paths. However, researchers found that by appending specific suffixes, such as ๐ฌ๐๐ ๐จ๐๐ง๐ซ๐๐๐ descriptors, the filter can be tricked into treating protected endpoints as public.
In particular, adding parameters like ๐ฌ๐จ๐๐ก-style or ๐ฌ๐๐๐ก-style suffixes to certain URL paths convinces the filter that the request targets documentation or metadata instead of an active REST handler. Searchlight Cyberโs write-up shows how appending ๐๐๐๐๐พ๐๐๐๐ ๐ฌ๐๐๐ก to specific management URLs gives unauthenticated access where authentication should apply.ย
Because the bypass logic sits in a central filter, attackers can reuse the same trick across multiple REST paths rather than hunting for one-off misconfigurations.
๐ ๐ซ๐จ๐ฆ ๐๐ฒ๐ฉ๐๐ฌ๐ฌ ๐ญ๐จ ๐ฉ๐ซ๐-๐๐ฎ๐ญ๐ก ๐๐๐ ๐ฏ๐ข๐ ๐๐ซ๐จ๐จ๐ฏ๐ฒ
Once the attacker steps past the REST security filter, the exploit chain reaches a Groovy-based compilation endpoint. Under normal conditions, this endpoint compiles scripts in a controlled way and does not act as a generic execution engine. Nevertheless, the research team showed that Groovyโs annotation-processing features allow compile-time execution of attacker-controlled code.ย
By sending carefully crafted requests to that Groovy endpoint, an attacker who already bypassed authentication can instruct the server to run arbitrary commands during compilation. As a result, the full chain from crafted URL suffix to RCE runs before any user identity is validated. That property makes CVE-2025-61757 a ๐ฉ๐ซ๐-๐๐ฎ๐ญ๐ก๐๐ง๐ญ๐ข๐๐๐ญ๐ข๐จ๐ง RCE with a CVSS score of 9.8, which matches how runZero, Penligent and others describe its impact.ย
๐๐๐ญ๐ข๐ฏ๐ ๐๐ฑ๐ฉ๐ฅ๐จ๐ข๐ญ๐๐ญ๐ข๐จ๐ง ๐ฌ๐ข๐ ๐ง๐ฌ ๐๐ง๐ ๐๐๐ซ๐ฅ๐ฒ ๐ณ๐๐ซ๐จ-๐๐๐ฒ ๐ญ๐ข๐ฆ๐๐ฅ๐ข๐ง๐
The vulnerability did not stay theoretical for long. Oracle addressed CVE-2025-61757 in its ๐๐๐ญ๐จ๐๐๐ซ ๐๐๐๐ ๐๐ซ๐ข๐ญ๐ข๐๐๐ฅ ๐๐๐ญ๐๐ก ๐๐ฉ๐๐๐ญ๐, which covered Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 among many other products. Shortly afterward, Searchlight Cyber released a technical article that included enough detail for threat actors to reproduce the exploit.
However, SANS Internet Storm Center data suggests someone may have discovered and weaponized the issue earlier. Their handlers observed repeated requests against Oracle Identity Manager URLs with the telltale ๐จ๐๐ข๐๐๐ค๐ก๐ค๐ฃ ๐ฌ๐๐๐ก suffix as early as late August and early September, well before Oracle shipped the patch. The traffic came from multiple IP addresses but used the same user agent, which points to one actor scanning broadly rather than random noise.
Those probes targeted endpoints such as
/iam/governance/applicationmanagement/templates;.wadl
/iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl
which match the exploit path documented in public research. =
๐๐๐๐โ๐ฌ ๐๐๐ ๐๐๐ญ๐๐ฅ๐จ๐ ๐๐ง๐ ๐ญ๐ก๐ ๐ฉ๐๐ญ๐๐ก ๐๐๐๐๐ฅ๐ข๐ง๐
CISA has now added CVE-2025-61757 to its ๐๐ง๐จ๐ฐ๐ง ๐๐ฑ๐ฉ๐ฅ๐จ๐ข๐ญ๐๐ ๐๐ฎ๐ฅ๐ง๐๐ซ๐๐๐ข๐ฅ๐ข๐ญ๐ข๐๐ฌ catalog, which serves as the authoritative list of vulnerabilities with confirmed exploitation in the wild. When a CVE lands in KEV, federal civilian agencies receive a hard deadline to mitigate under Binding Operational Directive 22-01. For CVE-2025-61757, that window runs only a few weeks from listing to required remediation.ย
Even though the directive formally applies to U.S. Federal Civilian Executive Branch environments, private-sector defenders often treat KEV entries as a priority list as well, because historically these vulnerabilities attract ongoing exploitation across industries.
๐๐๐๐ง๐ญ๐ข๐ญ๐ฒ-๐ญ๐ข๐๐ซ ๐ซ๐ข๐ฌ๐ค: ๐๐๐ฒ๐จ๐ง๐ ๐๐จ๐๐ ๐๐ฑ๐๐๐ฎ๐ญ๐ข๐จ๐ง
Technical details aside, the real risk comes from where this remote code execution lands. Oracle Identity Manager does not just live on a random app server; it orchestrates account creation, entitlement assignments and approval flows that span on-prem directories and cloud services. Penligentโs analysis frames CVE-2025-61757 as a โhigh-leverage identity-tier compromise route,โ and that description fits.
If attackers gain code execution on OIM, they can attempt to tamper with provisioning logic, grant themselves accounts in critical systems, interfere with deprovisioning, or harvest credentials and connection details used by the platform. Consequently, defenders should treat this vulnerability on par with serious domain controller or SSO platform bugs, not as a generic middleware issue.
๐๐๐ญ๐๐๐ญ๐ข๐จ๐ง ๐๐ง๐ ๐ก๐ฎ๐ง๐ญ๐ข๐ง๐ ๐ข๐๐๐๐ฌ ๐๐จ๐ซ ๐๐๐-๐๐๐๐-๐๐๐๐๐
Security teams who manage Oracle Identity Manager estates gain visibility by combining several angles. First, they examine web and reverse-proxy logs for REST requests against ๐๐๐ข / ๐๐ค๐ซ๐๐ง๐ฃ๐๐ฃ๐๐ paths that include suffixes like ๐จ๐๐ข๐๐๐ค๐ก๐ค๐ฃ ๐ฌ๐๐๐ก or ๐ฆ๐ช๐๐ง๐ฎ ๐ฌ๐จ๐๐ก, especially when those requests come from unfamiliar IP ranges.ย
Next, they correlate any such requests with application logs and operating-system telemetry on the OIM servers. Sudden Groovy compilation activity against unusual scripts, unexpected child processes spawned by the application server or anomalous JAR loading behavior all merit investigation. Where organizations collect full-packet data, they look for repeated POST requests to those paths followed by new outbound connections from the same host.
Finally, they align those observations with asset-inventory data. runZero and similar platforms have already published fingerprints to help security teams locate Oracle Identity Manager instances on their networks and estimate exposure before or after exploit attempts.ย
๐๐๐ญ๐๐ก๐ข๐ง๐ ๐๐ง๐ ๐ก๐๐ซ๐๐๐ง๐ข๐ง๐ ๐๐ซ๐๐๐ฅ๐ ๐๐๐๐ง๐ญ๐ข๐ญ๐ฒ ๐๐๐ง๐๐ ๐๐ซ
In the short term, organizations that run vulnerable Oracle Identity Manager versions must apply the October 2025 Critical Patch Update that covers CVE-2025-61757. Oracleโs advisory and patch-availability documents list supported Identity Manager releases and direct administrators to the necessary downloads through My Oracle Support.
In parallel, security teams review how OIMโs REST interfaces are exposed. They restrict management endpoints to administrative networks or VPN-only access wherever possible instead of leaving them open on public interfaces. They also consider placing identity-tier admin surfaces behind additional authentication layers, such as reverse proxies that enforce strong upstream auth before requests hit Oracleโs stack.
Longer term, Penligent and SANS both argue that organizations should treat this event as a forcing function to audit identity-plane exposure more broadly: which identity services sit directly on the internet, which rely on brittle filters, which reuse anti-patterns such as path-based exemptions and where security teams lack telemetry around admin functions.
๐๐จ๐ง๐๐ฅ๐ฎ๐ฌ๐ข๐จ๐ง
CVE-2025-61757 reinforces a theme defenders see repeatedly: attackers gravitate toward identity-tier systems because control there unlocks everything upstream and downstream. A trivial-looking REST filter bypass combined with a Groovy compilation quirk now offers unauthenticated remote code execution against Oracle Identity Manager, and real-world traffic shows that threat actors already probe and exploit that path. When organizations treat OIM and similar platforms as critical infrastructure, aggressively apply Oracleโs October 2025 patches and harden how identity services face the network, they shrink both the current attack window and the next one that will inevitably appear.
๐ ๐๐๐ฌ
๐๐: ๐๐ก๐ข๐๐ก ๐๐ซ๐๐๐ฅ๐ ๐๐๐๐ง๐ญ๐ข๐ญ๐ฒ ๐๐๐ง๐๐ ๐๐ซ ๐ฏ๐๐ซ๐ฌ๐ข๐จ๐ง๐ฌ ๐๐ซ๐ ๐๐๐๐๐๐ญ๐๐ ๐๐ฒ ๐๐๐-๐๐๐๐-๐๐๐๐๐?
Public guidance points to Oracle Identity Manager versions in the 12.2.1.4.0 and 14.1.2.1.0 ranges as affected, with fixes delivered in the October 2025 Critical Patch Update. Because Oracle distributes detailed patch matrices through My Oracle Support, customers should consult that documentation to map exact build numbers and confirm whether their deployments require updates.ย
๐๐: ๐๐จ๐๐ฌ ๐ญ๐ก๐ข๐ฌ ๐๐ซ๐๐๐ฅ๐ ๐๐๐๐ง๐ญ๐ข๐ญ๐ฒ ๐๐๐ง๐๐ ๐๐ซ ๐๐๐ ๐ซ๐๐ช๐ฎ๐ข๐ซ๐ ๐ฏ๐๐ฅ๐ข๐ ๐๐ซ๐๐๐๐ง๐ญ๐ข๐๐ฅ๐ฌ?
No. CVE-2025-61757 is explicitly described as a ๐ฉ๐ซ๐-๐๐ฎ๐ญ๐ก๐๐ง๐ญ๐ข๐๐๐ญ๐ข๐จ๐ง remote code execution flaw. The exploit path uses REST API filter bypass tricks and a Groovy compilation endpoint before any normal user authentication logic runs. That property explains both the high CVSS score and CISAโs KEV prioritization.
๐๐: ๐๐จ๐ฐ ๐๐จ๐๐ฌ ๐ญ๐ก๐ข๐ฌ ๐๐ข๐๐๐๐ซ ๐๐ซ๐จ๐ฆ ๐จ๐ญ๐ก๐๐ซ ๐๐ซ๐๐๐ฅ๐ ๐๐๐ ๐๐๐ฌ๐๐ฌ ๐ข๐ง ๐๐๐๐โ๐ฌ ๐๐๐ ๐๐๐ญ๐๐ฅ๐จ๐ ?
CISAโs KEV catalog already includes multiple Oracle RCE flaws, such as those in Oracle E-Business Suite and Oracle Access Manager, that also allowed unauthenticated attackers to execute code over HTTP.ย CVE-2025-61757 stands out because it lives in an identity-management product rather than a general business application, which concentrates risk in the authentication and authorization layer instead of the transactional tier.
๐๐: ๐๐ก๐๐ญ ๐ข๐ ๐ฉ๐๐ญ๐๐ก๐ข๐ง๐ ๐๐ซ๐๐๐ฅ๐ ๐๐๐๐ง๐ญ๐ข๐ญ๐ฒ ๐๐๐ง๐๐ ๐๐ซ ๐ข๐ฆ๐ฆ๐๐๐ข๐๐ญ๐๐ฅ๐ฒ ๐ข๐ฌ ๐ง๐จ๐ญ ๐๐๐๐ฌ๐ข๐๐ฅ๐?
In that case, organizations still need interim risk reduction. They can restrict network access to OIM REST endpoints to dedicated admin networks or VPNs, place the service behind an authenticated reverse proxy and deploy virtual patches or WAF rules that block suspicious ๐ฌ๐๐๐ก / ๐ฌ๐จ๐๐ก-style patterns on sensitive paths. These steps do not replace the patch, but they reduce exposure while teams test and schedule upgrades. CIS+2runZero+2
