CVE-2025-61757: Oracle Identity Manager Auth Bypass Flaw Added to CISA’s KEV

CVE-2025-61757 is a critical authentication bypass vulnerability in Oracle Identity Manager, recently added to CISA's Known Exploited Vulnerabilities Catalog due to active exploitation. The flaw affects versions 12.2.1.4.0 and 14.1.2.1.0, with a CVSS score of 9.8, allowing pre-authenticated Remote Code Execution (RCE) via improperly protected REST API endpoints. Exploitation occurs through manipulation of request URIs, bypassing the central SecurityFilter.

Evidence of exploitation has been observed, with a mandatory patching deadline set for December 12, 2025, for U.S. federal agencies. Organizations at risk include government agencies and enterprises using affected versions. Immediate patching, log review for suspicious activity, and restricting public exposure are recommended mitigation strategies. SOCRadar offers tools to help organizations track exploitation and prioritize vulnerabilities.