Oracle Internet Directory CVE-2026-61241

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Internet Directory, requiring only network access to the OID LDAP Server (LDAP/LDAPS) listener; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity. The realistic limiting factor is network exposure: OID LDAP listeners are typically deployed on internal/management networks rather than the public internet, so an attacker must reach the LDAP port (commonly 3060/3131) - organizations that segment OID away from untrusted networks meaningfully reduce reachable attack surface. Only the two supported versions 12.2.1.4.0 and 14.1.2.1.0 are confirmed affected.

Every exploitation signal in the CVSS vector points to maximum, real-world priority: AV:N (network/LDAP-reachable), AC:L (low complexity, 'easily exploitable' per Oracle), PR:N (no authentication), UI:N (no user interaction), and S:C with C:H/I:H/A:H yielding the ceiling score of 10.0. The scope change is especially significant because OID is an identity backbone - compromise cascades to any Fusion Middleware or application relying on it for authentication. Counterbalancing signals: EPSS is not provided, the CVE is not in CISA KEV, and no POC is referenced, so this is 'no public exploit identified at time of analysis' rather than confirmed active exploitation. The absence of a CWE and of EPSS data are gaps, but they do not lower the assessed risk given a vendor-confirmed 10.0 on unauthenticated identity infrastructure - this is a genuine emergency-patch item, not a high-CVSS-but-low-real-risk case.

An attacker with network reachability to the OID LDAP listener sends a crafted LDAP request to the OID LDAP Server without any credentials, triggering the flaw and gaining administrative control over the directory. Because of the scope change, the attacker then leverages compromised OID as an identity backbone to forge or alter authentication data affecting downstream Fusion Middleware applications. No public POC is referenced, but the low attack complexity means weaponization would be straightforward once details emerge.