---
title: "Oracle Identity Manager CVE-2025-61757: Pre-Auth RCE"
url: https://erroneo.us/security/briefs/oracle-identity-manager-cve-2025-61757-pre-auth-rce/
description: "Auth bypass in Oracle Identity Manager REST APIs gives unauthenticated RCE; in CISA KEV. Fixed in the October 2025 CPU. Confirm the patch and hunt for ;.wadl."
type: security-brief
section: "Security Digest"
date_published: 2025-10-21
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-61757"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Oracle Identity Manager CVE-2025-61757: Pre-Auth RCE

**Verdict: Check exposure.** Oracle fixed this in its October 2025 CPU, and it has been exploited since. Confirm every OIM 12.2.1.4.0 and 14.1.2.1.0 instance carries that CPU or a later one, keep its REST APIs off untrusted networks, and search logs for ;.wadl requests.

- **Who must act:** Organizations running Oracle Identity Manager / Identity Governance 12.2.1.4.0 or 14.1.2.1.0 without the October 2025 Critical Patch Update, especially where /iam/governance is reachable from the internet or broad internal networks.
- **Who can relax:** Teams that applied the October 2025 or a later CPU promptly and expose OIM only to a small admin network; organizations that do not run Oracle Identity Manager.
- **Affected:** Oracle Identity Manager 12.2.1.4.0 without the October 2025 CPU; Oracle Identity Manager 14.1.2.1.0 without the October 2025 CPU
- **Fixed:** Oracle Critical Patch Update, October 2025 (Identity Manager 12.2.1.4.0 and 14.1.2.1.0); Later quarterly CPUs, which Oracle describes as usually cumulative
- **CVEs:** CVE-2025-61757
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every Oracle Identity Manager / Identity Governance deployment and its version (12.2.1.4.0 or 14.1.2.1.0).
2. Confirm the October 2025 CPU or a later one is installed with opatch lspatches, and apply it if not.
3. Block untrusted access to /iam/governance/ REST paths at the load balancer or WAF, and reject URLs containing ';.wadl' or '?WSDL' there.
4. Search WebLogic and proxy access logs back to August 2025 for ';.wadl' and groovyscriptstatus requests.
5. If you find signs of exploitation, treat OIM as fully compromised: rebuild it, rotate its service and connector credentials, and review accounts and roles it provisioned.

### How to check if you are affected

- grep WebLogic access logs (servers/<oim_server>/logs/access.log*) and proxy logs for ';.wadl' or '?WSDL' on /iam/governance/ paths.
- Look for POSTs to /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus, the Groovy compile endpoint used for code execution.
- Watch for the OIM Java/WebLogic process spawning shells or making new outbound connections.
- Review OIM for unexpected privileged accounts, role or entitlement changes, and provisioning jobs nobody approved.

## What happened

Oracle's [October 2025 Critical Patch Update](https://www.oracle.com/security-alerts/cpuoct2025.html), released October 21, 2025, fixed CVE-2025-61757. The flaw is in the REST WebServices component of Oracle Identity Manager (OIM), part of Fusion Middleware. Oracle rates it CVSS 3.1 9.8: exploitable over HTTP without credentials, and "can result in takeover of Identity Manager." Oracle credits Adam Kues and Shubham Shah of Assetnote, now part of Searchlight Cyber.

On November 20, 2025, [Searchlight Cyber](https://www.slcyber.io/research/breaking-oracles-identity-manager-pre-auth-rce) published the details. OIM's REST APIs rely on a central security filter that waves through WSDL and WADL requests. Because Java keeps path parameters in the URI, appending `;.wadl` to a protected path skips authentication. Behind it sits `groovyscriptstatus`, an endpoint that compiles Groovy scripts without running them. The researchers got code execution anyway with a Groovy annotation that runs at compile time. They also noted that the same bug would have worked against Oracle's own `login.us2.oraclecloud.com`, which ran OIM and was breached earlier in 2025 through an older flaw.

CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757) on November 21, 2025.

## Who is affected

Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 are affected unless the October 2025 CPU (or a later CPU) is applied. Oracle says its CPU patches are "usually cumulative." OIM is an identity provisioning hub. It holds connector credentials for directories, HR systems and applications, and it creates and changes accounts across them. Taking it over is close to taking over everything it provisions.

## Do you really need to act?

If you applied the October 2025 CPU or any later quarterly CPU, this is a verification exercise. If you did not, it is urgent: the exploit is one HTTP request plus a public technique, and Searchlight called it "somewhat trivial."

The exploitation record is murky. The [SANS Internet Storm Center](https://isc.sans.edu/diary/rss/32506) logged matching `;.wadl` POSTs between August 30 and September 9, 2025, before the patch, and asked whether it was zero-day use. The diary was later updated: Searchlight said those requests came from its own research. [Horizon3.ai](https://horizon3.ai/attack-research/vulnerabilities/cve-2025-61757/) says exploitation is nonetheless confirmed, and CISA has not shared who exploited it or how, per [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-warns-oracle-identity-manager-rce-flaw-is-being-actively-exploited/). As of Oct 23, 2026, no public attribution has been disclosed.

## What to do now

1. Inventory every OIM / Identity Governance deployment and its version.
2. On each Oracle home, run `$ORACLE_HOME/OPatch/opatch lspatches` and confirm the October 2025 CPU patch or a later one is installed. Use Oracle's patch availability document for Fusion Middleware to map patch numbers.
3. Limit `/iam/governance/` to trusted networks, and have the load balancer or WAF reject URLs containing `;.wadl` or `?WSDL` on those paths.
4. Search logs back to August 2025, for example `grep -E ';\.wadl|\?WSDL' servers/*/logs/access.log*` in the WebLogic domain.
5. If you find exploitation, rebuild OIM, rotate every connector and service credential it stores, and audit accounts and roles it provisioned.

## How to tell if you were hit

Oracle has published no indicators. Use the exploit's shape instead. Requests to `/iam/governance/` ending in `;.wadl` or `?WSDL` have no business reason. POSTs to `/iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus` from outside your admin tooling deserve scrutiny. The early-September hits SANS recorded from 89.238.132.76, 185.245.82.81 and 138.199.29.153 were attributed to Searchlight's research, so do not treat those addresses alone as proof of compromise. On the host, look for the WebLogic Java process spawning shells and for new outbound connections. In OIM, look for unexpected privileged accounts, role grants and provisioning jobs.

## Timeline

- Aug 30, 2025 — SANS sensors start logging matching requests (through Sep 9), later attributed to Searchlight's research.
- Oct 21, 2025 — Oracle's October 2025 CPU fixes CVE-2025-61757 (CVSS 9.8).
- Nov 20, 2025 — Searchlight Cyber publishes the technical write-up, and SANS posts its observations.
- Nov 21, 2025 — CISA adds the CVE to KEV, with a federal due date of December 12, 2025.

## Sources

1. [Oracle — Critical Patch Update Advisory, October 2025](https://www.oracle.com/security-alerts/cpuoct2025.html)
2. [CVE record — CVE-2025-61757](https://www.cve.org/CVERecord?id=CVE-2025-61757)
3. [NVD — CVE-2025-61757](https://nvd.nist.gov/vuln/detail/CVE-2025-61757)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-61757](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757)
5. [Searchlight Cyber — Breaking Oracle's Identity Manager: Pre-Auth RCE (CVE-2025-61757)](https://www.slcyber.io/research/breaking-oracles-identity-manager-pre-auth-rce)
6. [SANS ISC — Oracle Identity Manager exploit observation from September (CVE-2025-61757)](https://isc.sans.edu/diary/rss/32506)
7. [Horizon3.ai — CVE-2025-61757](https://horizon3.ai/attack-research/vulnerabilities/cve-2025-61757/)
8. [BleepingComputer — CISA warns Oracle Identity Manager RCE flaw is being actively exploited](https://www.bleepingcomputer.com/news/security/cisa-warns-oracle-identity-manager-rce-flaw-is-being-actively-exploited/)

---
Source page: https://erroneo.us/security/briefs/oracle-identity-manager-cve-2025-61757-pre-auth-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt