{"basis":"claimed","id":"CVE-2025-61757","name":"Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability","vendorProject":"Oracle","product":"Fusion Middleware","publishedAt":"2025-10-21","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2025-11-21","dueDate":"2025-12-12","ransomware":false},"epss":{"score":0.88647,"percentile":0.99773,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-11-21","daysToRule":31},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-12-03","daysToRule":43},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager.  Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cwes":["CWE-306"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-11-21","firstIsNew":true,"daysToRule":31,"daysAtMost":null,"freePlan":false,"claims":[{"id":"778ff2399527406281690dc5e8b4aa2abf0b63f87958d38dea04b2c829dbded8","cve_id":"CVE-2025-61757","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"fa584616fe2241608cb8bd1339fdbe7e","rule_name":"Oracle Identity Manager - Pre-Auth RCE - CVE:CVE-2025-61757","change":"new","default_action":"Block","published_on":"2025-11-21","source_url":"https://developers.cloudflare.com/changelog/post/2025-11-21-emergency-waf-release/","source_title":"WAF Release - 2025-11-21","excerpt":"Oracle Identity Manager - Pre-Auth RCE - CVE:CVE-2025-61757. Previous action: N/A. New action: Block. This is a new detection.","first_seen_at":"2026-11-02T21:00:15.788Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-12-03","firstIsNew":true,"daysToRule":43,"daysAtMost":null,"freePlan":false,"claims":[{"id":"d75c22c90e834e1d17053a7d4d990d0b280dbc61828fed81c61e5e7dcd57279f","cve_id":"CVE-2025-61757","vendor":"f5","product":"Attack signatures","rule_id":"200204047","rule_name":"Oracle Identity Manager Pre-Auth RCE","change":"new","default_action":null,"published_on":"2025-12-03","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200204047 \"Oracle Identity Manager Pre-Auth RCE\" (Server Side Code Injection, risk High), systems: Oracle Identity Manager. References: CVE-2025-61757.","first_seen_at":"2026-11-02T21:00:25.505Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:40.558Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2025-61757","templatePath":"http/cves/2025/CVE-2025-61757.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/iam/governance/applicationmanagement/api/v1/applications/groovyscripts…","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/iam/governance/applicationmanagement/api/v1/applications/groovyscripts…","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"passed","templateId":"CVE-2025-61757","templatePath":"http/cves/2025/CVE-2025-61757.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/iam/governance/applicationmanagement/api/v1/applications/groovyscripts…","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/iam/governance/applicationmanagement/api/v1/applications/groovyscripts…","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}