Research · Oct 21, 2025 · ZeroDay Catalog
Critical Vulnerability in Oracle Fusion Middleware Identity Manager
A severe vulnerability has been identified in Oracle Fusion Middleware's Identity Manager, allowing unauthenticated access that could lead to complete system compromise.
What changed
A critical vulnerability has been discovered in the Identity Manager component of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.1.0. This flaw allows unauthenticated attackers to exploit the system via HTTP, potentially leading to a complete takeover of the Identity Manager.
The vulnerability has been assigned a CVSS 3.1 Base Score of 9.8, indicating significant risks to confidentiality, integrity, and availability.
Who is affected
Organizations utilizing Oracle Fusion Middleware, particularly those running the affected versions of Identity Manager, are at risk.
The vulnerability poses a threat to any enterprise relying on Oracle's identity management solutions, potentially impacting sensitive data and operational integrity.
- Oracle Fusion Middleware Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0)
- Enterprises using Oracle's identity management solutions
- Organizations with network access to the affected systems
What to do
Immediate action is recommended to mitigate the risks associated with this vulnerability. Organizations should assess their exposure and implement necessary security measures.
Upgrading to the latest version of Oracle Fusion Middleware is crucial to protect against potential exploitation.
- Review and update to the latest supported version of Oracle Fusion Middleware.
- Implement network access controls to limit exposure to the Identity Manager.
- Monitor for any unauthorized access attempts and strengthen authentication mechanisms.