Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation of this Oracle Identity Manager remote code execution vulnerability has been observed. Immediate patching is recommended.

Oracle Identity Manager versions prior to 12.2.1.4.0 or prior to 14.1.2.1.0 are vulnerable to a Remote Code Execution through the REST WebServices component. An unauthenticated attacker can achieve remote code execution on the underlying server via a crafted REST request.

The 12.2.1.4.0 and 14.1.2.1.0 versions of Identity Manager installed on the remote host are affected by a vulnerability as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).
    Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful     attacks of this vulnerability can result in takeover of Identity Manager. (CVE-2025-61757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115045	Oracle Identity Manager < 12.2.1.4.0 / < 14.1.2.1.0 Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical
271391	Oracle Identity Manager (October 2025 CPU)	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2025-61757

critical

Tenable Plugins

critical

critical