The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is urging government agencies to immediately patch a critical Oracle Identity Manager flaw, tracked as CVE-2025-61757, which is actively exploited as a zero-day.
The vulnerability, discovered by Searchlight Cyber analysts Adam Kues and Shubham Shah, is a pre-authentication remote code execution (RCE) flaw caused by an authentication bypass in Oracle Identity Manager’s REST APIs. Attackers can trick the security filter into treating protected endpoints as public by adding parameters like ?WSDL or ;.wadl to URL paths.
Once inside, attackers can access a Groovy script compilation endpoint that normally doesn’t execute code—but can be abused to run malicious code at compile time via annotation-processing features, enabling full pre-auth RCE.
Oracle patched the issue in its October 2025 Critical Patch Update on October 21. However, Searchlight Cyber published a technical breakdown yesterday, warning that the bug is “trivial and easily exploitable.”
Actively exploited, CISA says
CISA has added CVE-2025-61757 to its Known Exploited Vulnerabilities (KEV) catalog and ordered Federal Civilian Executive Branch agencies to patch it by December 12, noting the severe threat it poses.
Though CISA hasn’t released exploitation details, SANS researcher Johannes Ullrich reported signs that attackers may have exploited the flaw as early as August 30, weeks before the fix. He logged repeated scans and HTTP POST requests matching the exploit method shared by Searchlight Cyber.
Targeted endpoints included:
- /iam/governance/applicationmanagement/templates;.wadl
- /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl
The activity originated from three IPs—89.238.132[.]76, 185.245.82[.]81, and 138.199.29[.]153—using the same Chrome 60 user agent, suggesting a single attacker.
Comments