CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability

Discover a critical Oracle Identity Manager zero-day vulnerability and learn how to protect your systems from active attacks.

By Content Team

Nov 22, 2025

ON THIS PAGE

CISA has added a critical Oracle Identity Manager zero-day vulnerability (CVE-2025-64446) to its Known Exploited Vulnerabilities catalog after confirming active attacks in the wild. The flaw scores a devastating 9.8 on the CVSS scale and lets attackers remotely execute code without any authentication required.

The vulnerability poses a major threat to organizations relying on Oracle Identity Manager for access control. Federal agencies face a mandatory patching deadline under CISA's Binding Operational Directive 22-01. Organizations should immediately apply patches and check their systems for signs of compromise, as hackers are already exploiting this security hole.

Source: The Hacker News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?