CVE-2025-61757 is a critical vulnerability in Oracle Identity Manager affecting versions 12.2.1.4.0 and 14.1.2.1.0. It involves missing authentication on a critical function, allowing unauthenticated remote code execution. The vulnerability arises from a flawed allow-list filter that can be bypassed by appending '?WSDL' or ';.wadl' to URIs, causing protected API endpoints to be treated as publicly accessible. Attackers can then send specially crafted HTTP POST requests to the '/iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus' endpoint to achieve remote code execution via Groovy annotations executed at compile time. The flaw was actively exploited before Oracle issued patches in their quarterly update. CISA has mandated patching by December 12, 2025, for federal agencies.

This vulnerability enables unauthenticated remote attackers to bypass authentication controls and execute arbitrary code remotely on affected Oracle Identity Manager installations. This can lead to full system compromise, privilege escalation, and lateral movement within an organization's network. The active exploitation prior to patch release increases the risk of widespread compromise. The vulnerability affects critical identity management infrastructure, potentially impacting enterprise security postures significantly.

Oracle has released official patches addressing this vulnerability in their quarterly updates. Affected organizations should apply these patches immediately. Federal Civilian Executive Branch agencies are required to patch by December 12, 2025. No alternative mitigations or workarounds are provided in the advisory. Patch status is confirmed as official-fix available.