Vulnerability intelligence
CVE-2025-61757
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Oracle Fusion Middleware
Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
CVSS Score
—
Unrated
EPSS — Exploit Probability
88%
Riskier than 100% of all CVEs · checked 2026-09-04
Exploitation
Confirmed in the wild
KEV since 2025-11-21
Remediation
Unconfirmed
Federal deadline 2025-12-12
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2025-12-12.
2 articles across 2 outlets · first covered Mar 20, 2026 · latest Mar 21, 2026
Coverage timeline
-
Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Managerthehackernews.com · Mar 21, 2026
-
Patch Now: Oracle's Fusion Middleware Has Critical RCE Flawwww.darkreading.com · Mar 20, 2026