A recently disclosed critical vulnerability in Oracle Identity Manager is now confirmed to be under active exploitation, underscoring how exposed enterprise identity infrastructure has become. The flaw, tracked as CVE-2025-61757, affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 and carries a CVSS score of 9.8. The issue is categorized as “missing authentication for a critical function,” and CISA has added it to its Known Exploited Vulnerabilities catalog with a remediation deadline of December 12 for federal agencies. Oracle issued its fix in the October 2025 Critical Patch Update, but many deployments appear to remain unpatched.
Oracle Identity Manager is a core component of Oracle Fusion Middleware and is widely deployed for identity governance and access management across large enterprises. It handles user lifecycle management, provisioning, and access to both on-premises and cloud applications. A pre-authentication remote code execution flaw in that layer effectively gives attackers a direct path to compromise not only the identity platform itself but also any downstream systems that trust it.
Technical analysis from independent researchers shows that the vulnerability stems from how Oracle’s SecurityFilter processes certain REST API requests. By manipulating URL paths with specific suffixes or parameters, an attacker can trick the filter into treating protected endpoints as unauthenticated. Once the filter is bypassed, the attacker can invoke a Groovy script status endpoint and execute arbitrary commands on the underlying server, achieving full remote code execution without valid credentials.
Given that Identity Manager often runs on heavily customized, long-lived middleware stacks, organizations may hesitate to apply patches due to concerns about breaking integrations. That delay creates a sizeable window of opportunity for threat actors. Public advisories are already urging organizations to assume that any internet-exposed Oracle Identity Manager instance that has not been patched since October may have been probed or compromised.
For security and identity teams, the priority is clear. First, identify and patch all affected Oracle Identity Manager instances, with particular urgency for systems accessible from the internet or partner networks. Second, conduct targeted threat hunting around those systems, reviewing web server and identity platform logs as well as downstream application logs. Finally, treat the identity tier as a high-value asset that requires the same segmentation, monitoring, and hardening typically reserved for domain controllers. This incident demonstrates how a single pre-auth flaw in the identity layer can undermine otherwise robust controls.
Sources: BleepingComputer
—
By Ali Nassar-Smith
