CVE-2025-61757

The vulnerability, classified as CWE-306 (missing authentication for critical function), allows an attacker to access REST WebServices interfaces without providing any credentials. An attacker with network access to the system via HTTP protocol can send requests to protected REST endpoints without prior authentication. The low attack complexity (AC:L) and lack of privilege requirements (PR:N) and user interaction (UI:N) make the exploit trivial to execute.

Successful exploitation of the vulnerability leads to complete takeover of the Oracle Identity Manager system, including breach of confidentiality, integrity, and availability of data and services. An attacker can gain unauthorized access to managed identities and user privileges across the entire organization.

Immediately apply patches provided by Oracle as part of the Critical Patch Update from October 2025, available at https://www.oracle.com/security-alerts/cpuoct2025.html. Until the patch is deployed, it is recommended to restrict network access to the Oracle Identity Manager REST WebServices component only to trusted hosts using firewall or ACL rules.

Oracle Identity Manager (Oracle Fusion Middleware component) in versions 12.2.1.4.0 and 14.1.2.1.0

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.