Oracle Internet Directory CVE-2026-61248

Exploitation requires network access to the OID LDAP Server interface and a low-privileged authenticated foothold in the directory (CVSS PR:L), meaning the attacker must already hold or acquire valid low-level LDAP credentials - this is the primary limiting factor and rules out anonymous, fully unauthenticated exploitation. No user interaction is needed (UI:N) and complexity is low (AC:L), so once credentials and LDAP reachability exist, exploitation against the affected supported versions (12.2.1.4.0 and 14.1.2.1.0) is straightforward. The scope change (S:C) means the impact is not confined to OID itself but can extend to products that trust the directory. What further limits real-world risk is that OID's LDAP listener should not be internet-exposed in well-segmented deployments, so exposure depends on network placement.

This is a genuine high-priority issue rather than an inflated high-CVSS score: the vector AV:N/AC:L/PR:L/UI:N is easily exploitable, requiring only network reachability to the LDAP service and a low-privileged account, with no user interaction and low attack complexity. The scope change (S:C) plus C:H/I:H/A:H is what drives the 9.9 and is the most alarming factor, because a directory-service takeover cascades into every application that trusts OID for identity, so a mid-sized operator running OID for internal SSO should treat this as urgent. Tempering that, exploitation is not fully unauthenticated (PR:L), so an attacker must already hold or obtain some directory credentials, which narrows the realistic threat to insiders, compromised service accounts, or post-foothold escalation. EPSS was not provided, there is no public exploit identified at time of analysis, and it is not in CISA KEV, so there is no evidence of active or widespread exploitation yet; the risk here is high impact and easy exploitation once a foothold exists, not confirmed mass exploitation. Note the data tension: the vendor tag says 'Information Disclosure,' but the CVSS shows full integrity and availability impact and describes 'takeover,' so the tag understates the actual impact - trust the vector and description over the tag.

An attacker who has obtained a low-privileged OID account (for example a compromised service account or a limited internal user) connects to the OID LDAP Server over the network and issues crafted LDAP operations that exploit the flaw to escalate to full control of the directory. Because of the scope change, the attacker then leverages control of OID to forge or alter identity and authorization data trusted by downstream Fusion Middleware applications. No public exploit code has been identified at time of analysis, and no user interaction is required.