Back to CVE Browser

CVE-2025-61757

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-10-21

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Platforms (CPE)

📦

Oracle

Identity Manager

= 12.2.1.4.0= 14.1.2.1.0

References & Advisories

🔗 https://www.oracle.com/security-alerts/cpuoct2025.html

🔗 https://isc.sans.edu/diary/rss/32506

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757

Related Security Intelligence Articles

Global Cyber Intel Digest: July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

Global Cyber Intel Digest: July 21, 2026

Comprehensive breakdown of critical vulnerability advisories across VMware vCenter, F5 BIG-IP, and GitLab platforms, alongside threat actor reconnaissance trends and ransomware response strategies.

Related Vulnerabilities

CVE-2026-148566.3

A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, ca...

CVE-2026-400001.8

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files...

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expir...

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute...