Critical Oracle Identity Manager Flaw Possibly Exploited as Zero-Day

According to Searchlight Cyber, CVE-2025-61757 is a critical pre-authentication remote code execution vulnerability affecting Oracle Identity Manager that was disclosed recently. Oracle fixed CVE-2025-61757 with its October 2025 patches and has confirmed it is a critical issue that can be exploited without authentication. The exploit chains an authentication bypass with arbitrary code execution, enabling attacker access and potentially full system compromise.

SANS Technology Institute’s Johannes Ullrich noted that possible exploitation was seen several times between August 30 and September 9, weeks before Oracle released a patch, with multiple IP addresses using the same user agent. SecurityWeek has reached out to Oracle for comment, while Searchlight has also been asked whether the activity observed by SANS could have involved its own researchers.