CISA Reports Active Exploitation of Oracle Identity Manager Flaw

The U.S. Cybersecurity and Infrastructure Security Agency announced on November 21, 2025, that a critical vulnerability in Oracle Identity Manager, part of the company's Fusion Middleware platform, has been actively exploited by attackers. Tracked as CVE-2025-61757, the flaw allows unauthenticated remote attackers with HTTP network access to bypass authentication and execute arbitrary code, potentially leading to a full compromise of the identity management system.

The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Identity Manager, a tool used for user credential and identity security in enterprise environments. According to CISA, it stems from a missing authentication mechanism for a critical function in the REST Web Services component. Security researchers from Searchlight Cyber, including Adam Kues and Shubham Shah, identified the issue earlier in the year while investigating a separate breach of Oracle Cloud services. They reported it to Oracle, which addressed it in the company's October 2025 Critical Patch Update. The flaw received a severity score of 9.8 out of 10 on the CVSS scale, highlighting its ease of exploitation without requiring prior...