CISA Confirms Exploitation of Recent Oracle Identity Manager Vulnerability

The cybersecurity agency CISA has confirmed the exploitation of a recently patched Oracle Identity Manager vulnerability, tracked as CVE-2025-61757, which allows unauthenticated attackers to execute remote code. This flaw was reported by Searchlight Cyber, who discovered it and warned that it could lead to privilege escalation and data exposure. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog, urging federal agencies to address it by December 12.

Despite the reported exploitation, Oracle has not confirmed any attacks in the wild. The SANS Technology Institute found potential attack attempts linked to this vulnerability, but Searchlight clarified that some activity was related to their research efforts.