Oracle Identity Manager CVE-2025-61757 Auth Bypass

Tim Peck@timpeck

•updated Dec 2, 2025•3•2•104

Detects HTTP requests targeting the Oracle Identity Manager REST API that contain known authentication bypass suffixes, such as `?WSDL` or `;.wadl`. This indicates an attempt to exploit the initial authentication bypass stage of the CVE-2025-61757 exploit chain.