Oracle Internet Directory CVE-2026-83056

Requires network access to the OID LDAP Server component of Oracle Internet Directory (versions 12.2.1.4.0 or 14.1.2.1.0) plus low-privilege credentials to conduct LDAP operations (PR:L, not pre-authentication). No user interaction is needed (UI:N) and complexity is low (AC:L). The primary limiting factor is the authentication requirement - the attacker must already hold some valid low-privilege LDAP access - which distinguishes this from the fully unauthenticated critical siblings in the same Oracle September 2026 CPU. The scope change (S:C) means successful exploitation additionally impacts downstream Fusion Middleware products that rely on OID for identity services.

This is a genuine high priority within enterprise Oracle Fusion Middleware environments, but the raw 9.9 score should be read with nuance. The vendor CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is internally consistent and well-calibrated: the 'low privileged attacker' language matches PR:L (not pre-auth), and the described 'significant impact to additional products' matches the scope change (S:C), which is the metric that pushes an otherwise-9.1 authenticated flaw up to 9.9. All three impact metrics are High, consistent with the stated full takeover of Oracle Internet Directory. However, exploitation is NOT unauthenticated - it requires some existing low-privilege access, which is a meaningful limiter versus the pre-auth 9.8/10.0 siblings in the same Oracle September 2026 CPU. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automatable exploitation at this time - the priority rests on the severity and the ubiquity of directory infrastructure, not on observed exploitation. The Oracle CPU advisory (cspusep2026) provides zero technical detail, so the attack mechanism cannot be independently verified. Net: patch on the standard critical-CPU cadence, prioritized by the directory's central role in authentication, but do not treat it as an actively-exploited emergency absent KEV/POC signals.

A low-privileged user with network access to the OID LDAP Server (e.g. an authenticated LDAP bind, even with minimal directory privileges) sends crafted LDAP operations that exploit the flaw to escalate to full control of Oracle Internet Directory. Because of the scope change, the compromise extends beyond OID itself to other Fusion Middleware products that trust it for identity and authentication. No public exploit code is identified at time of analysis.