U.S. CISA adds an Oracle Fusion Middleware flaw to its Known Exploited Vulnerabilities catalog

According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, Oracle Fusion Middleware has been added to the Known Exploited Vulnerabilities (KEV) catalog as CVE-2025-61757, a flaw with a CVSS score of 9.8. The vulnerability is a missing authentication for a critical function that can allow a pre-authenticated remote code execution, and it is easily exploitable by an unauthenticated attacker with HTTP network access to takeover Oracle Identity Manager.

It affects versions 12.2.1.4.0 and 14.1.2.1.0, which Oracle addressed in the Oracle Critical Patch Update Advisory – October 2025. The disclosure notes that private researchers from Assetnote, Adam Kues and Shubham Shah, reported the vulnerability. Security researchers reported honeypot activity showing HTTP POST attempts targeting the Identity Manager endpoint between 30 August and 9 September 2025, with attempts traced to several IPs, suggesting exploitation as a zero-day before Oracle’s patch.

CISA also emphasised the need for federal agencies to remediate by the due date and for organisations to review the KEV catalog to protect their infrastructures, with a fix deadline set for 12 December 2025.