Description
Oracle Identity Manager 是 Oracle 提供的一款身份管理解决方案。该漏洞存在于 /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl 接口中，攻击者可以通过发送特制的 Groovy 脚本，利用命令执行漏洞在目标服务器上执行任意命令，可能导致敏感信息泄露、系统被完全控制等严重后果。
Oracle Identity Manager /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl 命令执行漏洞（CVE-2025-61757）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-61757
https://slcyber.io/research-center/breaking-oracles-identity-manager-pre-auth-rce/
https://socprime.com/active-threats/cve-2025-61757/
https://isc.sans.edu/diary/32506
https://www.oracle.com/security-alerts/cpuoct2025.html
https://github.com/gobysec/GobyVuls/blob/master/CVE-2025-61757.md
https://thehackernews.com/2025/11/cisa-warns-of-actively-exploited.html
https://beazley.security/alerts-advisories/critical-vulnerability-in-oracle-oim-under-active-exploitation
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-110/
https://www.rescana.com/post/critical-zero-day-exploited-in-oracle-identity-manager-cve-2025-61757-pre-auth-rce-vulnerability