CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability

According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, one critical Oracle Identity Manager vulnerability—CVE-2025-61757 with a CVSS of 9.8—has been added to the Known Exploited Vulnerabilities catalog due to active exploitation. The flaw allows pre-authenticated remote code execution and affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, with Oracle addressing it as part of its October 2025 quarterly updates.

Searchlight Cyber researchers Adam Kues and Shubham Shah, who discovered the flaw, explained that it enables access to API endpoints that can manipulate authentication flows, escalate privileges, and move laterally across core systems. The bypasses of a security filter can be triggered by adding “?WSDL” or “;.wadl” to a URI, and exploiting the endpoint /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus can yield remote code execution via a crafted HTTP POST.

With honeypot evidence and comments from Johannes B. Ullrich, the analysis suggests the vulnerability may have been exploited as a zero‑day before Oracle’s patch, and FCEB agencies are urged to patch by 12 December 2025.