CVE-2025-61757: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

CVE-2025-61757 is a missing authentication for critical function vulnerability in Oracle Fusion Middleware. It allows unauthenticated remote attackers to take over Identity Manager. For organizations running this middleware stack, especially those relying on its identity services, the issue matters because it can give an external attacker control over a core identity component without any credentials. Confirm all product-specific details against the vendor advisory.

CISA notes that the flaw enables takeover of Identity Manager and requires applying mitigations per vendor instructions, following applicable BOD 22-01 guidance for cloud services, or discontinuing use if mitigations are unavailable. Known ransomware use is not documented.

How it works

This vulnerability falls under CWE-306, Missing Authentication for Critical Function. In products of this class, a critical operation—here related to Identity Manager within Oracle Fusion Middleware—can be reached and exercised without the expected authentication checks. An unauthenticated remote attacker who can reach the affected interface or endpoint can invoke that function and thereby gain control of Identity Manager.

Exact request formats, parameters, or attack sequences are not provided in the public summary; treat any such details as requiring confirmation against the vendor advisory. The practical risk is that the attacker obtains administrative or equivalent control over identity management capabilities without first authenticating, which can cascade into broader access within the environment that depends on that identity service.

Am I affected? How to find it in your systems

Oracle Fusion Middleware commonly appears in enterprise application platforms, identity and access management deployments, and integration layers that sit between web applications and backend services. Identity Manager components are typically part of larger Oracle identity suites used for provisioning, authentication, and authorization.

• Inventory all hosts and cloud instances running Oracle Fusion Middleware; check configuration management databases, software asset inventories, and package or installer records for Fusion Middleware installations.
• Identify any Identity Manager modules or related services; note their network exposure (internal only versus internet-facing or partner-accessible).
• Review version and patch levels against the vendor advisory for CVE-2025-61757; specifics of affected builds must be confirmed there rather than assumed.
• Examine access logs, application logs, and web server or reverse-proxy logs for unauthenticated requests hitting Identity Manager endpoints or administrative functions. Look for anomalous successful operations that should have required authentication, spikes in traffic to identity-related URLs, or unexpected configuration or user-management changes.
• If the environment is cloud-hosted, apply the same inventory and logging checks and also follow BOD 22-01 guidance for cloud services as referenced by CISA.

How to remediate

Patch first. Apply the vendor update or mitigation named in the Oracle advisory for CVE-2025-61757. Follow the vendor’s installation and verification steps exactly, then re-test that the critical Identity Manager functions now enforce authentication as expected.

• After patching, validate that unauthenticated access to the previously exposed critical functions is blocked.
• Harden remaining authentication and authorization controls around Identity Manager: enforce strong authentication, least privilege for administrative roles, and network-level restrictions so that only trusted management networks can reach administrative interfaces.
• If the product is used as a cloud service, implement the applicable BOD 22-01 controls in addition to the vendor patch.
• If no mitigation is available from the vendor, plan to discontinue use of the affected product as directed by CISA until a fix exists.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls appropriate to a missing-authentication flaw on a critical identity function.

• Segment Identity Manager and related Fusion Middleware components so they are reachable only from trusted internal management networks; block direct internet or untrusted partner access at the firewall or security group layer.
• Place a web application firewall or reverse proxy in front of any exposed endpoints and apply virtual patching rules that reject unauthenticated requests to critical Identity Manager functions; tune rules carefully and monitor for false positives.
• Disable or restrict any non-essential Identity Manager features or interfaces that are not required for business operations, provided this can be done without breaking production identity flows.
• Increase monitoring and alerting on authentication failures, successful unauthenticated operations, and any changes to users, roles, or policies within Identity Manager. Retain logs long enough for forensic review.
• If the service is cloud-based, apply the cloud-specific compensating measures outlined in BOD 22-01 while preparing for the permanent vendor fix or product retirement.

If your data may have been exposed

Actively exploited vulnerabilities of this class can lead to full compromise of identity systems and subsequent data exposure or lateral movement. If you have evidence of exploitation or cannot rule it out, treat the incident as a potential breach: isolate affected systems, preserve logs, and follow your incident-response and notification procedures. You can run a free exposure scan of your email addresses against known breach data to check whether credentials or personal information associated with your organization have already appeared in public breach corpora.