A critical vulnerability has been disclosed in Oracle Identity Manager, specifically affecting the Oracle Identity Governance Suite 12c (12.2.1.4.0). Tracked as CVE-2025-61757, this flaw allows unauthenticated remote attackers to execute arbitrary code on affected systems, posing a severe risk to enterprise and government networks. The vulnerability stems from a pre-authentication WADL retrieval flaw in the Java servlet, which processes certain API calls as valid even without authentication, exposing restricted REST endpoints such as /iam/governance/applicationmanagement.

Security researchers at Researcher discovered that this flaw turns a seemingly harmless Groovy syntax-checking endpoint (/groovyscriptstatus) into a vector for full remote code execution. By injecting a script with the @ASTTest annotation, attackers can force the Java compiler to execute arbitrary code during compilation. This effectively converts the syntax-checking service into a remote shell, giving attackers unrestricted control over the host system, including the ability to deploy malware or ransomware.

The vulnerability is particularly dangerous because it requires no prior credentials or access, combining a trivial authentication bypass with a reliable method for code execution. This makes it an attractive target for ransomware operators and state-sponsored threat actors. Its severity is rated Critical, as exploitation can lead to full system compromise and unauthorized access to sensitive identity and governance data. This incident follows a prior Oracle Cloud login service breach that exposed over six million records, highlighting ongoing risks in Oracle’s identity management ecosystem.

Organizations using Oracle Identity Governance Suite 12c are strongly advised to apply the available security patches immediately or isolate affected services from the public internet to prevent exploitation. In addition, security teams should conduct thorough audits of API endpoints, monitor for suspicious activity, and review access controls to detect any potential compromise. Prompt remediation is essential to mitigate the high-impact threat posed by this vulnerability.