Intruvent Technologies
Contact us
9.8
Critical CVE Analysis Active Zero-Day CISA KEV TLP:CLEAR

CVE-2025-61757

Oracle Identity Manager Pre-Authentication Remote Code Execution

Critical pre-authentication RCE in Oracle Identity Manager (CVSS 9.8). Attackers bypass authentication via URL suffix manipulation and achieve code execution through Groovy annotation abuse. Over 300,000 attack attempts recorded globally since zero-day exploitation began in August 2025.

ACTIVE ZERO-DAY EXPLOITATION

CISA KEV deadline: December 12, 2025. Zero-day exploitation observed from August 30 - September 9, 2025, prior to patch release. Over 300,000 attack attempts across 18+ countries targeting computing, healthcare, and business sectors.

CVSS Score
9.8 Critical
Affected Product
Oracle Identity Manager
CWE
CWE-306
Attack Count
300,000+
1
Executive Summary
Active Zero-Day Exploitation
CVE-2025-61757 has been actively exploited since late August 2025, weeks before Oracle released a patch. CISA added this vulnerability to the KEV catalog on November 21, 2025, with a remediation deadline of December 12, 2025.

CVE-2025-61757 is a critical pre-authentication remote code execution vulnerability in Oracle Identity Manager (OIM), part of Oracle Fusion Middleware. The flaw exploits:

Attack Chain

  1. Authentication Bypass: Append ;.wadl or ?WSDL to protected endpoints
  2. Target Groovy Endpoint: POST to groovyscriptstatus endpoint
  3. Annotation Abuse: Craft Groovy script with malicious annotation processors
  4. RCE Achieved: Execute arbitrary code during compilation phase

Key Facts

  • CVSS 9.8 Critical - No authentication required
  • Affects Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0
  • Zero-day exploitation observed Aug 30 - Sep 9, 2025
  • 300,000+ attack attempts in 18+ countries
  • Primary targets: Computing, Healthcare, Business Services

Full report content will be loaded from Artemis.
Contact us if you need the complete report.

Detect Oracle Identity Manager Exploitation with BRACE

BRACE provides detection for enterprise identity infrastructure attacks including:

  • Oracle Fusion Middleware exploitation patterns
  • Authentication bypass attempt detection
  • Groovy/WebLogic RCE indicators
  • Identity system compromise detection
Learn More About BRACE Request Demo

Related Reports

Critical CVE Analysis

CVE-2024-55591: FortiOS

Another critical authentication bypass in enterprise infrastructure.

View Analysis →
Critical Threat Actor

Scattered Spider

Identity-focused threat group targeting enterprise authentication.

View Profile →
Critical CVE Analysis

Next.js Vulnerabilities

Web application authorization bypass and RCE vulnerabilities.

View Analysis →

Protect Your Enterprise Identity Infrastructure

BRACE monitors for exploitation of identity management vulnerabilities and provides continuous detection for CISA KEV listed CVEs.

Get BRACE Talk to an Expert