Trending
CVE-2025-61757

CVE detail

CVE-2025-61757

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 9.8 · CriticalBuzz score 61.5KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 61.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 22.0 · diversity 14.5 · KEV 25.0 · OTX 0.0 · PoC 0.0

Mention score

22.0

8 evidence mentions in the snapshot

Diversity score

14.5

5 sources across 2 categories

KEV score

25.0

Known exploited vulnerability present

OTX score

0.0

0 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 0; within the 30d window
Peak daily: 0; highest bucket

Evidence

Source links by recency

Newest mentions first

8 source links · newest first

Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992)Help Net Security
Oracle has released an out-of-band patch for a critical and easily exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager. The company did not say whether the vulnerability has been exploited as a zero-day, but has urged customers to apply the updates or provided mitigations as soon as possible. About CVE-2026-21992 CVE-2026-21992 is caused by missing authentication for a critical function. In Oracle Identity Manager – a solution for provisioning, managing and … More →
newswww.helpnetsecurity.comMar 23, 2026, 11:06 AM
Oracle fixes critical RCE flaw CVE-2026-21992 in Identity ManagerSecurity Affairs
Oracle fixed a critical severity flaw, tracked as CVE-2026-21992, enabling unauthenticated remote code execution in Identity Manager. Oracle released security updates to address a critical vulnerability, tracked as CVE-2026-21992 (CVSS score of 9.8), affecting Identity Manager and Web Services Manager. The flaw lets unauthenticated attackers over HTTP take control of Oracle Identity Manager and Web […]
newssecurityaffairs.comMar 22, 2026, 3:37 PM
CVE-2025-61757Horizon3.ai
Oracle Identity Manager Pre-Auth RCE | CISA KEV
exploithorizon3.aiNov 24, 2025, 10:14 PM
CISA Confirms Exploitation of Recent Oracle Identity Manager VulnerabilitySecurityWeek
CISA has added CVE-2025-61757 to its Known Exploited Vulnerabilities (KEV) catalog.
newswww.securityweek.comNov 24, 2025, 3:37 PM
Oracle OIM zero‑day: Pre‑auth RCE forces rapid patching across enterprisesCSO Online
The Cybersecurity and Infrastructure Security Agency (CISA) has flagged a pre-authenticated, critical remote code execution flaw in Oracle Identity Manager (OIM), noting that it has been actively exploited, and added it to its Known Exploited Vulnerabilities (KEV) catalog. The flaw was first identified by Searchlight Cyber, which found it capable of allowing complete authentication bypass, […]
newswww.csoonline.comNov 24, 2025, 11:28 AM
Security Affairs newsletter Round 551 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. BadAudio malware: how APT24 scaled its cyberespionage through supply chain attacks U.S. CISA adds an Oracle […]
newssecurityaffairs.comNov 23, 2025, 1:18 PM
U.S. CISA adds an Oracle Fusion Middleware flaw to its Known Exploited Vulnerabilities catalogSecurity Affairs
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an Oracle Fusion Middleware flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a an Oracle Fusion Middleware flaw, tracked as CVE-2025-61757 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is a missing authentication for a critical function that […]
newssecurityaffairs.comNov 22, 2025, 10:34 AM
Critical Oracle Identity Manager Flaw Possibly Exploited as Zero-DaySecurityWeek
CVE-2025-61757 is an unauthenticated remote code execution vulnerability affecting Oracle Identity Manager.
newswww.securityweek.comNov 21, 2025, 1:46 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2026-61196
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0.…
CVSS 9.8 · Critical
1 mention
CVE-2026-60329
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0.…
CVSS 9.8 · Critical
1 mention
CVE-2026-46807
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVSS 9.8 · Critical
1 mention
CVE-2026-35267
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easi…
CVSS 8.8 · High
1 mention
CVE-2026-35265
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily explo…
CVSS 8.8 · High
1 mention
CVE-2026-21992
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware…
CVSS 9.8 · Critical
7 mentions

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2025-61757.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

cpe:2.3:a:oracle:identity_managerSearch this product on Shodan

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2025-61757Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Unavailable

Published

Oct 21, 2025

Modified

Jun 17, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE IDs

Vendor classifications

How this vector reads

CVSS 3.1 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Privileges Required (PR): None. The attacker needs no privileges on the vulnerable system.
User Interaction (UI): None. Exploitation does not require another user to act.
Scope (S): Unchanged. Impacts remain within the vulnerable security authority.
Confidentiality Impact (C): High. There is a total or serious impact to this security property.
Integrity Impact (I): High. There is a total or serious impact to this security property.
Availability Impact (A): High. There is a total or serious impact to this security property.

Signals

Exploitation indicators

1 stored signals · KEV present · 0 OTX pulses

KEVKEV
- cwes: CWE-306
- dueDate: 2025-12-12
- knownRansomwareCampaignUse: Unknown
- notes: https://www.oracle.com/security-alerts/cpuoct2025.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61757
- product: Fusion Middleware
- requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- shortDescription: Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
- vendorProject: Oracle
- vulnerabilityName: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Observed Nov 21, 2025, 12:00 AM