Overview

A critical Remote Code Execution (RCE) vulnerability has been identified in Oracle Identity Manager (OIM). The flaw allows unauthenticated remote attackers to execute arbitrary code via HTTP, leading to complete system compromise. This vulnerability is actively exploited and listed in the CISA Know Exploited Vulnerabilities (KEV) Catalogue.

Description

The vulnerability, CVE-2025-64446, arises from a relative path traversal flaw combined with authentication bypass logic in FortiWeb’s API/GUI management interface. 

An attacker sends a crafted HTTP/HTTPS POST request to a vulnerable endpoint (for example: /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi) which bypasses intended authentication controls and reaches a legacy CGI handler. 

Through this access, the attacker can create administrative accounts, modify configuration, execute arbitrary commands on the device and pivot into the network.

Impact

Successful exploitation of this vulnerability can result in: 

• Full takeover of the Oracle Identity Manager environment

• Manipulation of identity and access workflows 

• Unauthorized privilege escalation 

• Lateral movement to other integrated enterprise systems • Leakage of sensitive identity information

Severity: 

• CVSS Score: 9.8 (Critical) 

• Attack Vector: Network 

• Privileges Required: None 

• User Interaction: None 

• Status: Actively Exploited 

Solution

Oracle has released a security patch for this vulnerability. Users and administrators are encouraged to apply necessary updates. 

Indicators of Compromise (IoCs): 

• Requests to OIM endpoints ending in .wadl 

• Anonymous access attempts to OIM REST Web Services 

• Known malicious IPs interacting with OIM servers: 

• - 89.238.132[.]76
• - 185.245.82[.]81
• - 138.199.29[.]153 

• Abnormal Groovy execution entries in logs 

References

• 1. https://www.oracle.com/security-alerts/public-vuln-to-advisory-mapping.html
• 2. https://nvd.nist.gov/vuln/detail/CVE-2025-61757
• 3. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• 4. https://thehackernews.com/2025/11/cisa-warns-of-actively-exploited.html