Oracle exploit: IAM under attack

Ye Olde Fashioned authentication filters in a Groovy codebase to blame.

Nov 23, 2025 3:37 PM 3 min read

Oracle exploit: IAM under attack — Image credit: https://unsplash.com/@simmerdownjpg

Customers running Oracle’s Identity Manager (OIM) software are exposed to a critical pre-auth RCE vulnerability that is being actively exploited.

Per CVE.org: CVE-2025-61757 (CVSS 9.8) is an “easily exploitable vulnerability [that] allows unauthenticated attacker with network access via HTTP to compromise Identity Manager [for] takeover of Identity Manager.”

It stems from the use of “very error-prone” authentication filters in its Apache Groovy/Java codebase that are “almost always bypassable” according to the researchers credited by Oracle with the vulnerability disclosure.

This content is for members only

Already have an account? Sign in

Add The Stack on Google

Edward Targett

Ed is a co-founder of The Stack. He previously edited Computer Business Review. He has also covered energy markets. He started his journalism career on local papers. He left school at 15 and has made a living asking "but why?" ever since.