erroneo.us
Search all guides⌘K

Security Digest · Oct 21, 2025 · Vulnerability · Identity

Oracle Identity Manager CVE-2025-61757: Pre-Auth RCE

Auth bypass in Oracle Identity Manager REST APIs gives unauthenticated RCE; in CISA KEV. Fixed in the October 2025 CPU. Confirm the patch and hunt for ;.wadl.

Published By erroneo.us Security Desk · Updated 3 min read8 sources

Our verdict

Check exposure

Oracle fixed this in its October 2025 CPU, and it has been exploited since. Confirm every OIM 12.2.1.4.0 and 14.1.2.1.0 instance carries that CPU or a later one, keep its REST APIs off untrusted networks, and search logs for ;.wadl requests.

Who must act: Organizations running Oracle Identity Manager / Identity Governance 12.2.1.4.0 or 14.1.2.1.0 without the October 2025 Critical Patch Update, especially where /iam/governance is reachable from the internet or broad internal networks.

Who can relax: Teams that applied the October 2025 or a later CPU promptly and expose OIM only to a small admin network; organizations that do not run Oracle Identity Manager.

Affected
Oracle Identity Manager 12.2.1.4.0 without the October 2025 CPU
Oracle Identity Manager 14.1.2.1.0 without the October 2025 CPU
Fixed in
Oracle Critical Patch Update, October 2025 (Identity Manager 12.2.1.4.0 and 14.1.2.1.0)
Later quarterly CPUs, which Oracle describes as usually cumulative
CVSS
9.8 (v3.1, vendor)
EPSS
88.6% (percentile 99.8)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. List every Oracle Identity Manager / Identity Governance deployment and its version (12.2.1.4.0 or 14.1.2.1.0).
  2. Confirm the October 2025 CPU or a later one is installed with opatch lspatches, and apply it if not.
  3. Block untrusted access to /iam/governance/ REST paths at the load balancer or WAF, and reject URLs containing ';.wadl' or '?WSDL' there.
  4. Search WebLogic and proxy access logs back to August 2025 for ';.wadl' and groovyscriptstatus requests.
  5. If you find signs of exploitation, treat OIM as fully compromised: rebuild it, rotate its service and connector credentials, and review accounts and roles it provisioned.

How to check if you are affected or compromised

  • grep WebLogic access logs (servers/<oim_server>/logs/access.log*) and proxy logs for ';.wadl' or '?WSDL' on /iam/governance/ paths.
  • Look for POSTs to /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus, the Groovy compile endpoint used for code execution.
  • Watch for the OIM Java/WebLogic process spawning shells or making new outbound connections.
  • Review OIM for unexpected privileged accounts, role or entitlement changes, and provisioning jobs nobody approved.

What happened#

Oracle's October 2025 Critical Patch Update, released October 21, 2025, fixed CVE-2025-61757. The flaw is in the REST WebServices component of Oracle Identity Manager (OIM), part of Fusion Middleware. Oracle rates it CVSS 3.1 9.8: exploitable over HTTP without credentials, and "can result in takeover of Identity Manager." Oracle credits Adam Kues and Shubham Shah of Assetnote, now part of Searchlight Cyber.

On November 20, 2025, Searchlight Cyber published the details. OIM's REST APIs rely on a central security filter that waves through WSDL and WADL requests. Because Java keeps path parameters in the URI, appending ;.wadl to a protected path skips authentication. Behind it sits groovyscriptstatus, an endpoint that compiles Groovy scripts without running them. The researchers got code execution anyway with a Groovy annotation that runs at compile time. They also noted that the same bug would have worked against Oracle's own login.us2.oraclecloud.com, which ran OIM and was breached earlier in 2025 through an older flaw.

CISA added the CVE to the KEV catalog on November 21, 2025.

Who is affected#

Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 are affected unless the October 2025 CPU (or a later CPU) is applied. Oracle says its CPU patches are "usually cumulative." OIM is an identity provisioning hub. It holds connector credentials for directories, HR systems and applications, and it creates and changes accounts across them. Taking it over is close to taking over everything it provisions.

Do you really need to act?#

If you applied the October 2025 CPU or any later quarterly CPU, this is a verification exercise. If you did not, it is urgent: the exploit is one HTTP request plus a public technique, and Searchlight called it "somewhat trivial."

The exploitation record is murky. The SANS Internet Storm Center logged matching ;.wadl POSTs between August 30 and September 9, 2025, before the patch, and asked whether it was zero-day use. The diary was later updated: Searchlight said those requests came from its own research. Horizon3.ai says exploitation is nonetheless confirmed, and CISA has not shared who exploited it or how, per BleepingComputer. As of Oct 23, 2026, no public attribution has been disclosed.

What to do now#

  1. Inventory every OIM / Identity Governance deployment and its version.
  2. On each Oracle home, run $ORACLE_HOME/OPatch/opatch lspatches and confirm the October 2025 CPU patch or a later one is installed. Use Oracle's patch availability document for Fusion Middleware to map patch numbers.
  3. Limit /iam/governance/ to trusted networks, and have the load balancer or WAF reject URLs containing ;.wadl or ?WSDL on those paths.
  4. Search logs back to August 2025, for example grep -E ';\.wadl|\?WSDL' servers/*/logs/access.log* in the WebLogic domain.
  5. If you find exploitation, rebuild OIM, rotate every connector and service credential it stores, and audit accounts and roles it provisioned.

How to tell if you were hit#

Oracle has published no indicators. Use the exploit's shape instead. Requests to /iam/governance/ ending in ;.wadl or ?WSDL have no business reason. POSTs to /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus from outside your admin tooling deserve scrutiny. The early-September hits SANS recorded from 89.238.132.76, 185.245.82.81 and 138.199.29.153 were attributed to Searchlight's research, so do not treat those addresses alone as proof of compromise. On the host, look for the WebLogic Java process spawning shells and for new outbound connections. In OIM, look for unexpected privileged accounts, role grants and provisioning jobs.

Timeline#

  • — SANS sensors start logging matching requests (through Sep 9), later attributed to Searchlight's research.
  • — Oracle's October 2025 CPU fixes CVE-2025-61757 (CVSS 9.8).
  • — Searchlight Cyber publishes the technical write-up, and SANS posts its observations.
  • — CISA adds the CVE to KEV, with a federal due date of December 12, 2025.

Vulnerability records

  • CVE-2025-61757 · KEV 2025-11-21 · Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Oracle — Critical Patch Update Advisory, October 2025 oracle.com
  2. CVE record — CVE-2025-61757 cve.org
  3. NVD — CVE-2025-61757 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2025-61757 cisa.gov
  5. Searchlight Cyber — Breaking Oracle's Identity Manager: Pre-Auth RCE (CVE-2025-61757) slcyber.io
  6. SANS ISC — Oracle Identity Manager exploit observation from September (CVE-2025-61757) isc.sans.edu
  7. Horizon3.ai — CVE-2025-61757 horizon3.ai

Coverage and analysis

  1. BleepingComputer — CISA warns Oracle Identity Manager RCE flaw is being actively exploited bleepingcomputer.com