EXPOSURES › CVE-2025-61757

CVE-2025-61757

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2025-11-21 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2025-61757 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 72/100 exploited-in-wildunpatched

Oracle Fusion Middleware exposed to unauthenticated takeover via Identity Manager

Oracle Fusion Middleware lacked authentication controls, allowing remote attackers to seize control of Identity Manager without authentication, potentially leading to unauthorized data access.

Shame score — Critical vulnerability actively exploited with no patch available, leading to potential unauthorized data access and system takeover.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

Oracle · vendor Fusion Middleware · product

DESCRIPTION

Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.

AFFECTED FEDRAMP PRODUCTS · 10

PRODUCT	PROVIDER	STATUS	MATCH
Aconex for Defense Oracle	Oracle	Authorized	vendor-exact · 0.90
Federal Managed Cloud Services Oracle	Oracle	Authorized	vendor-exact · 0.90
Fusion Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Government Cloud - Common Controls Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Cloud Infrastructure-Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) - Moderate Oracle	Oracle	In Process	vendor-exact · 0.90
Oracle Service Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Service Cloud (DOD) Oracle	Oracle	Authorized	vendor-exact · 0.90
Taleo Cloud - U.S. Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90