Oracle Identity Manager Exploit Observation from September (CVE-2025-61757), (Thu, Nov 20th)

Searchlight Cyber disclosed CVE-2025-61757 in Oracle Identity Manager: appending ";.wadl" to endpoints bypasses authentication and can enable RCE. Oracle released a patch in the October CPU; log review found multiple pre-patch POST attempts to a vulnerable endpoint from different IPs using the same user-agent and a 556-byte payload (request bodies not captured). Early scans may have originated from Searchlight's research, but the observed activity constitutes scanning/exploitation attempts and includes actionable IOCs (IPs, user-agent, targeted URL).