CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability
Summary: CISA added CVE-2025-61757, a CVSS 9.8 missing-authentication flaw in Oracle Identity Manager affecting versions 12.2.1.4.0 and 14.1.2.1.0, to its Known Exploited Vulnerabilities catalog on Friday, citing evidence of active exploitation. Searchlight Cyber researchers Adam Kues and Shubham Shah found the flaw can be triggered by appending "?WSDL" or ";.wadl" to any URI to bypass a regex-based allow-list, then paired with a POST to the groovyscriptstatus endpoint to achieve remote code execution.
Key Takeaway: SANS's Johannes B. Ullrich reported honeypot logs showing POST attempts against that exact endpoint between August 30 and September 9, 2025, all sharing one user agent and a 556-byte payload - suggesting a single attacker exploited it as a zero-day before Oracle shipped a patch. FCEB agencies now have until December 12, 2025 to patch, and Identity Manager sits in the authentication path of the core systems the flaw lets an attacker move laterally across.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-61757
- Related
- CVE-2025-61757: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Nov 21, 2025