Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting Oracle Identity Manager to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability in question is CVE-2025-61757 (CVSS score: 9.8), a case of missing authentication for a critical function that can result in pre-authenticated
Analysis Summary
# Vulnerability: Critical Authentication Bypass Leading to RCE in Oracle Identity Manager
## CVE Details
- CVE ID: CVE-2025-61757
- CVSS Score: 9.8 (Critical)
- CWE: Missing Authentication for Critical Function
## Affected Systems
- Products: Oracle Identity Manager (part of Oracle Fusion Middleware)
- Versions: 12.2.1.4.0 and 14.1.2.1.0
- Configurations: Applicable to deployments utilizing the affected Identity Manager versions.
## Vulnerability Description
The vulnerability is a critical authentication bypass flaw stemming from an incorrectly configured security filter, which relies on error-prone regular expressions or string matching against the request URI. Attackers can bypass this filter by appending specific strings (e.g., `?.WSDL` or `;.wadl`) to a URI, causing protected API endpoints to be treated as publicly accessible. This bypass can then be chained with an HTTP POST request to the endpoint `/iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus` to achieve pre-authenticated Remote Code Execution (RCE). Although this endpoint is intended only for Groovy code syntax checking, researchers found a mechanism to inject a Groovy annotation that executes at compile time, leading to code execution.
## Exploitation
- Status: **Exploited in the wild** (Added to CISA KEV catalog)
- Complexity: Low (Implied by pre-authenticated RCE vector)
- Attack Vector: Network
## Impact
- Confidentiality: High (Potential for takeover/data access)
- Integrity: High (Potential for system manipulation)
- Availability: High (Potential for system disruption)
## Remediation
### Patches
- Patches were addressed by Oracle as part of their October 2025 critical patch updates (CPU). Specific patched versions include those released in the October 2025 CPU cycle.
### Workarounds
- No specific workarounds detailed in the summary, but immediate patching is strongly urged due to active exploitation.
## Detection
- **Indicators of Compromise (IoCs):** Search activity observed between August 30 and September 9, 2025, targeting the URL paths:
- `/iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl` via HTTP POST requests.
- Payloads observed via honeypot logs had a Content-Length header of 556 bytes.
- **Detection Methods and Tools:** Network monitoring, web application firewalls (WAFs), and intrusion detection systems should be configured to alert on requests containing `?.WSDL` or `;.wadl` appended to URIs leading to Identity Manager APIs, particularly POST requests against the `/groovyscriptstatus` endpoint.
## References
- CISA Known Exploited Vulnerabilities Catalog (Specific link not provided, but referenced by CISA alert)
- Oracle Security Advisory: cpuoct2025 dot html (For detailed patch information)
- Security Researchers (Searchlight Cyber) Analysis