IT Consultancy
IT Consultancy Get expert guidance to leverage technology for your business growth. We help you identify the right IT solutions, optimize infrastructure, and ensure your digital environment is secure,…
CISA Issues Warning About Actively Exploited Critical Vulnerability in Oracle Identity Manager
Digital Marketing
Digital Marketing Grow your brand and reach the right audience with data-driven marketing strategies. We help you create campaigns that convert, manage social channels effectively, and optimize your d…
Privacy Policy
Privacy Policy At CometSoul, accessible from https://cometsoul.com, one of our main priorities is the privacy of our visitors. This Privacy Policy document contains types of information that is collec…
Terms and Conditions
Welcome to CometSoul! These terms and conditions outline the rules and regulations for the use of CometSoul’s Website, located at https://cometsoul.com. By accessing this website we assume you a…
Disclaimer
If you require any more information or have any questions about our site’s disclaimer, please feel free to contact us. Disclaimers for CometSoul All the information on this website – https…
Managed Wi-Fi Service
Managed Wi-Fi Service Build a fast, stable, and secure Wi-Fi for your business at Zero depreciation cost. Enterprise-Grade Guest Wi-Fi With $0 Upfront Hardware Costs. We provide, install, and support …
Smart Business System Integrator
Smart Business System Integrator Simplify your daily operations with smart systems that automate bookings, schedules, and routine tasks so you can focus on growing your business. We set up and integra…
IT Procurement & Hardware Managed Service
IT Procurement & Hardware Managed Service Keep your technology running smoothly from the hardware you use every day to the systems that power your business. We provide end-to-end IT management so …
CISA has released an alert about a critical security flaw in Oracle Identity Manager that is now being actively exploited. The vulnerability is tracked as CVE-2025-61757 and carries a CVSS score of 9.8.
Zero-Day Vulnerability in Oracle Identity Manager
CVE-2025-61757 is a missing authentication flaw in a key function. Because of this issue, attackers can execute remote code without logging in. The vulnerability affects the following versions:
- 12.2.1.4.0
- 14.1.2.1.0
Oracle already released a patch for this problem in last month’s quarterly update.
Impact of the Attack
According to researchers at Searchlight Cyber, attackers can use this flaw to:
- access APIs without authentication
- manipulate the login flow
- escalate privileges
- move laterally into an organization’s core systems
The issue occurs because attackers can bypass security filters by adding simple parameters—such as ?WSDL or ;.wadl—to protected URLs.
Exploitation Already Observed
Honeypot logs have detected attempts to access sensitive endpoints since late August 2025. This activity shows that exploitation started before the official patch was released.
Security Recommendations
CISA urges all organizations to:
- install the latest Oracle updates immediately
- review all production systems
- monitor for suspicious API activity
For U.S. government agencies, applying the patch is mandatory by December 12, 2025.
Source: https://thehackernews.com/2025/11/cisa-warns-of-actively-exploited.html