EUVD-2026-61343
GHSA-qxxg-fqfj-q9wf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easy remote unauthenticated LDAP exploitation resulting in full directory takeover, giving AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Internet Directory. Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the LDAP service over the network can take over the directory instance. The flaw scores CVSS 9.8 with high confidentiality, integrity, and availability impact and is addressed in Oracle's August 2026 Critical Patch Update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only prerequisite is network reachability to the OID LDAP Server (typically TCP 3060/3061) on an affected instance running Oracle Internet Directory 12.2.1.4.0 or 14.1.2.1.0 - no authentication, no user interaction, and no non-default configuration is required per the CVSS vector AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuine high-priority issue: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates trivially exploitable, remote, unauthenticated compromise with full impact across all three security properties, and Oracle explicitly describes the outcome as 'takeover.' No EPSS score, SSVC decision, or KEV entry was provided in the intelligence, and no public POC is identified, so the maturity of real-world exploitation is currently unknown rather than confirmed - meaning severity is high but observed exploitation is unproven. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixes delivered in Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html); this is the primary and only vendor-sanctioned fix - patch available per vendor advisory, though Oracle's CPU model does not publish a single discrete 'fixed version' string beyond the CPU-level patch for 12.2.1.4.0 and 14.1.2.1.0, so obtain the specific patch bundle for your version from My Oracle Support. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running affected Oracle Fusion Middleware versions (12.2.1.4.0 and 14.1.2.1.0) and document network-accessible LDAP service ports (389 unencrypted, 636 TLS); immediately implement network-level restrictions to limit LDAP access to authorized internal subnets and named clients only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Internet Directory
View allA Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2
Complete takeover of Oracle Internet Directory (OID) is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.
Privilege escalation to full takeover in Oracle Internet Directory (OID) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileg
Vulnerability in the Oracle Internet Directory component of Oracle Fusion Middleware (subcomponent: Oracle Directory Ser
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/serv
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today