Oracle Identity Manager Pre-Auth RCE: CVE-2025-61757 Explained

Du'aine Davis · 2025-11-28T11:46:34+00:00

Observed in the wild * In January 2025, Oracle Cloud’s login service was compromised, exposing 6 million records and 140,000 tenants. The breach stemmed from exploitation of an older CVE, and subsequent research uncovered a new pre-authentication remote code execution (RCE) vulnerability (CVE-2025-61757) in Oracle Identity…

Du'aine Davis

Observed in the wild

In January 2025, Oracle Cloud’s login service was compromised, exposing 6 million records and 140,000 tenants. The breach stemmed from exploitation of an older CVE, and subsequent research uncovered a new pre-authentication remote code execution (RCE) vulnerability (CVE-2025-61757) in Oracle Identity Manager, widely used by enterprises and government bodies.
The flaw arises from a bypassable central authentication filter in Oracle Identity Governance Suite 12c. Attackers can append ;.wadl or ?WSDL to REST API endpoints to evade authentication, then exploit the Groovy script compilation endpoint using annotation-based payloads for RCE. This vulnerability is easily exploitable and mirrors patterns seen in Java-based enterprise apps.
Organisations should apply Oracle’s latest patches immediately and monitor for suspicious REST API requests containing ;.wadl or ?WSDL. Organisations are advised to monitor unusual outbound connections or Groovy-related activity, and enforce strict network egress controls to block callbacks.

Breaking Oracle’s Identity Manager: Pre-Auth RCE (CVE-2025-61757) › Searchlight Cyber

Find more posts tagged with

Threat Landscape

Sign in to participate and unlock exclusive content 🔓

It looks like you're new here! Sign in or register to be able to comment, access member-only content and follow the spaces relevant to you.

Comments

There are no comments yet

See what's trending

Click on a tag to discover all the published content related to it.