CVE-2025-61757 is a missing authentication for critical function vulnerability in Oracle Fusion Middleware. CISA added it to the Known Exploited Vulnerabilities catalogue on 21 November 2025, which means attackers have used it in real attacks. Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
Why this vulnerability is dangerous in Oracle Fusion Middleware
Missing authentication for a critical function means the product exposes an action that should have required proof of identity. In Oracle Fusion Middleware, that matters because the vulnerable path can let a remote attacker reach Identity Manager without logging in, turning a control-plane flaw into direct account takeover potential.
The danger is not just that unauthenticated access is possible, but that the affected function sits close to identity operations. When attackers can reach identity administration or workflow functions without a valid session, they may be able to create, alter, or abuse access paths before defenders notice.
How organisations should assess exposure
Exposure starts with inventory: identify every Oracle Fusion Middleware deployment, every internet-facing instance, and every environment where Identity Manager is enabled or reachable. The practical question is whether the vulnerable service can be contacted from outside trusted networks, not whether the application is merely installed somewhere in the estate.
Review Oracle’s advisory for exact product and fix guidance, then cross-check the situation against the NIST National Vulnerability Database and the CVE Program record to confirm scope and tracking details. For organisations that prioritise exposure management, a structured vulnerability management guide is useful because this kind of flaw needs asset scoping, remediation tracking, and verification, not just patch awareness.
Remediation and compensating controls
Remediation should follow the vendor’s fixed-version guidance, but organisations often need interim controls when patching is delayed. Reduce exposure by removing internet access where possible, restricting administrative paths, segmenting management interfaces, and tightening allowlists around the affected service.
Because the issue is unauthenticated access to a critical function, compensating controls should assume that perimeter filtering alone may be brittle. If a patch cannot be applied immediately, treat the service as high risk and minimize who can reach it, from where they can reach it, and what identity-related actions the service can perform.
Detection and post-incident review
After exploitation, the key question is whether the attacker used the unauthenticated path to establish persistent access or alter identity-related configuration. Review authentication logs, administrative events, unusual requests to the vulnerable function, and any unexpected changes to users, roles, connectors, or federation settings.
If exploitation is suspected, review the broader environment for credential theft, session abuse, or follow-on movement. Oracle Fusion Middleware sits in a place where a single weakness can become a stepping stone into other systems, so post-patch review should verify not only that the vulnerability is closed, but that no unauthorized changes were left behind.
Risk and Threat Considerations
This class of flaw is dangerous because it removes the gate between an external attacker and a function that should only be available to authenticated, trusted users. In practice, that can turn a single web exposure into control of identity workflows, downstream access, or administrative settings.
Failure mechanism: The application accepts a request to a sensitive function without verifying the caller’s identity, so the attacker can invoke privileged logic directly and bypass normal access controls.
Impact: Attackers may take over Identity Manager, create or modify access, and use the compromised middleware as a foothold for broader compromise, data theft, or persistence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Missing authentication directly concerns user verification before privileged access. |
| AC-6 — Least Privilege | A critical function exploit can abuse excessive reach if privileged paths are too broad. | |
| SI-2 — Flaw Remediation | The term is a live vulnerability that requires tracking, remediation, and verification. | |
| Recommendation — Enforce IA-2 to require authenticated access before any critical identity function executes. Apply AC-6 to minimize who can invoke administrative and identity management functions. Use SI-2 to prioritize patching, validate remediation, and confirm the flaw is closed. | ||
| ISO/IEC 27001:2022 | A.8.5 — Secure Authentication | The vulnerability is an authentication failure on a critical function. |
| A.8.20 — Network Security | Exposure management depends on restricting reachability to the vulnerable service. | |
| Recommendation — Implement secure authentication controls for all externally reachable critical functions. Restrict network access to management and identity endpoints until remediation is complete. | ||
Practitioner Guidance
Why practitioners should care: This is the kind of vulnerability where delay changes the outcome, because exposed identity functions can be abused quickly once they are found. Treat internet exposure and reachable management paths as an immediate priority, not a theoretical concern.
What to watch for: Look for unexpected requests to identity or administrative endpoints, unexplained configuration changes, and any sign that accounts, connectors, or trust relationships were altered without an approved change.
Practitioner takeaway: For authentication failures on critical functions, the safest assumption is that exposure equals active risk until the affected path is patched, restricted, and reviewed.
Related resources from NHI Mgmt Group
- CVE-2025-32433 (Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function)
- CVE-2023-28461 (Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function)
- CVE-2023-27532 (Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function)
- CVE-2026-20253 (Splunk Enterprise Missing Authentication for Critical Function)