EUVD-2026-79382
GHSA-62q3-584q-3xgr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OID LDAP port over network
-
DeliverySend crafted LDAP bind/request
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain full directory control
-
ImpactRead/modify identity data and disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over LDAP against default configurations of Oracle Internet Directory (OID LDAP Server), affecting versions 12.2.1.4.0 and 14.1.2.1.0. The only prerequisite is network reachability to the OID LDAP service port (typically 389, or 636 for LDAPS); no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L) are required. Limiting factors are minimal: exposure is reduced only where the LDAP listener is network-segmented or firewalled from untrusted networks, and where the environment is not on an affected version. No non-default feature toggle is described as required. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes an unauthenticated, network-reachable, low-complexity attack requiring no user interaction that results in full compromise of Oracle Internet Directory - a directory/identity backbone, which raises the blast radius since OID typically fronts authentication and identity data for many downstream applications. The 9.8 score is well-calibrated to the described pre-auth LDAP takeover and is consistent with sibling pre-auth CWE-287 flaws in the same Oracle September 2026 CPU (e.g. CVE-2026-83021 at 10.0, CVE-2026-82995 at 9.8). Signals are, however, incomplete and partly conflicting: there is NO EPSS score, NO CISA KEV listing, NO public PoC, and NO SSVC decision data in the input, so exploitation status is 'no public exploit identified at time of analysis' - real-world exploitation cannot be asserted. The Oracle advisory (cspusep2026) provides zero technical detail (no endpoint, LDAP operation, or overflow specifics), so the exact defect behind the CWE-287 'Authentication Bypass' label is unverified. Net: treat as urgent to patch given the trivially-exploitable pre-auth profile and the sensitivity of a directory server, while recognizing that no active-exploitation evidence exists yet. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network access to the OID LDAP Server port (typically 389/636) sends a crafted LDAP request that bypasses authentication (CWE-287) and gains full control of Oracle Internet Directory, allowing read/modify of all directory entries and disruption of the identity service. Because OID underpins authentication for other Fusion Middleware components, the attacker can pivot to broader identity compromise. No public exploit code is identified at time of analysis, and Oracle's advisory withholds technical detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authentication bypass in the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker with network access to the LDAP listener to take full control of the directory service, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the flaw sits in the authentication path itself (CWE-287) and requires no credentials, no user interaction, and no special configuration, any instance whose LDAP port (typically 389, or 636 for LDAPS) is reachable from an untrusted network should be treated as exposed. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and no EPSS score was supplied, but the pre-authentication nature and the directory's role as a central identity store make this a genuine high-priority issue rather than a high-score/low-risk artifact.
RemediationAI
Apply the fix published in Oracle's security alert for this issue (https://www.oracle.com/security-alerts/cspusep2026.html), which is the authoritative source for the exact patched build; no specific fix version number is stated in the supplied intelligence, so verify the target version against that advisory rather than assuming any release. Because the exploit is unauthenticated and network-reachable, the highest-value compensating control - if patching cannot be immediate - is to restrict LDAP access on the OID listener (default TCP 389, and 636 for LDAPS) to trusted application subnets using host firewalls or network ACLs, accepting the trade-off that any legitimate client outside those ranges will lose directory connectivity until rules are updated. Where OID is only consumed by a small set of middleware hosts, binding the listener to specific interfaces or placing it behind an LDAP-aware proxy that enforces client allow-lists provides additional containment, though a proxy that does not itself authenticate still forwards malformed bind attempts and should be monitored. Review and disable anonymous or unauthenticated bind configurations in the directory if enabled, since they broaden the attack surface, and enable OID audit logging for bind and administrative operations so that anomalous pre-authentication activity can be detected. Enabling LDAPS alone is not a mitigation. Rotate directory administrator credentials and any service-account credentials stored in the directory once the patch is applied, on the assumption that a successful pre-authentication bypass may have permitted credential or configuration disclosure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Internet Directory (OID) is Oracle Fusion Middleware's LDAPv3-compliant directory server, typically deployed as the enterprise identity and authorization store behind Oracle Fusion Middleware, Oracle E-Business Suite, and custom LDAP-integrated applications. The vulnerability resides in the OID LDAP Server component and is classified as CWE-287 (Improper Authentication), meaning the server's bind/authentication logic can be subverted so that an attacker obtains authenticated or privileged directory context without presenting valid credentials. Given the assessed vector (AV:N, AC:L, PR:N, UI:N, S:U, C:H/I:H/A:H), the attack is conducted over the standard LDAP protocol with no prior access - in effect a pre-authentication compromise of the directory service itself, which the Oracle advisory characterizes as a takeover. The affected EUVD-listed versions are Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0; no CPE strings were supplied with the source data, so version matching should be performed against Oracle's own product/version inventory. Note that wrapping the listener in TLS (LDAPS on 636) does not mitigate the issue, since the flaw is in the authentication logic reached after transport establishment, not in transport confidentiality.
Know when Internet Directory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated network LDAP access (AV:N/PR:N/UI:N), easily exploitable (AC:L), and full takeover of OID (C:H/I:H/A:H) with no cross-component scope change described (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Internet Directory. Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Internet Directory - the central identity store that underpins authentication and authorization for enterprise applications and users - is exposed to a pre-authentication bypass in its OID LDAP Server component, affecting versions 12.2.1.4.0 and 14.1.2.1.0, where any party able to reach the LDAP listener can seize full control of the directory service without credentials. Because the flaw sits in the authentication path itself and requires no user interaction, a successful compromise would let an attacker read, alter, or destroy the identity data that downstream systems trust, with follow-on risk to enterprise-wide access decisions and service availability. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, but the unauthenticated, network-reachable nature of this defect makes it an immediate exposure-management priority for the security organization.
No vendor-released patch identified at time of analysis. Interim mitigations: block or allowlist TCP 389 and 636 at perimeter and host firewalls so only trusted application and administrative subnets can reach the LDAP listener; segment directory servers away from general user and untrusted networks; require LDAPS/TLS and place a hardened LDAP proxy or authentication gateway in front of any listener that must remain reachable; enable LDAP bind and administrative-operation logging with alerting on anomalous or anonymous bind activity; and pre-stage a change and rollback plan so the vendor fix can be deployed within hours of its release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Internet Directory
View allTakeover of Oracle Internet Directory via its LDAP server component allows unauthenticated remote attackers to fully com
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2
Complete takeover of Oracle Internet Directory (OID) is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.
Privilege escalation to full takeover in Oracle Internet Directory (OID) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileg
Unauthenticated remote attackers can achieve full takeover of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by rea
Authentication bypass in Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with netwo
Unauthenticated attackers with network access to the OID LDAP Server component can fully compromise Oracle Internet Dire
Unauthenticated remote takeover of Oracle Internet Directory is achievable through its OID LDAP Server component in vers
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4
Vulnerability in the Oracle Internet Directory component of Oracle Fusion Middleware (subcomponent: Oracle Directory Ser
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/serv
Exploit-DB