EUVD-2026-79385
GHSA-fhfg-g2vc-6p9p
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine high-priority issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) is well-calibrated and internally consistent: network-reachable via LDAP, low attack complexity, only low-level privileges needed, no user interaction, a scope change extending impact to other products, and full CIA compromise ('takeover'). The 9.9 rather than a perfect 10.0 correctly reflects PR:L instead of PR:N - the attacker must already hold some authenticated foothold (e.g., any low-privilege LDAP bind), which is the single most important limiting factor. Against that, EPSS is not provided, there is no CISA KEV listing, and no public exploit was identified, so there is no evidence of active or imminent widespread exploitation yet; SSVC decision data was not supplied. As an authentication/directory service, OID is a high-value target whose compromise cascades into every application depending on it for identity, so the scope-change rating is credible. Net: real risk warranting prompt patching, but current exploitation likelihood signals are absent (no KEV/POC/EPSS), suggesting priority driven by impact and product criticality rather than confirmed in-the-wild activity. CWE is unspecified (N/A) and Oracle's CPU provides no technical detail, so the exact flaw class cannot be verified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 can be taken over by a low-privileged attacker with network access to the OID LDAP server, an easily exploitable condition that Oracle rates at CVSS 3.1 base 9.9. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates no user interaction is needed, only a low-privileged LDAP-reachable position, and that the scope change lets the impact extend beyond OID to dependent products, with full loss of confidentiality, integrity and availability on the directory itself. This is a genuine high-priority issue for organizations exposing OID LDAP services; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the immediate driver is the large attack surface of directory services rather than confirmed active exploitation.
RemediationAI
The primary action is to apply the Oracle Fusion Middleware patch identified in the vendor security alert at https://www.oracle.com/security-alerts/cspusep2026.html; no exact fix version or patch number is present in the provided intelligence, so version-specific fix details must be confirmed directly against that advisory rather than assumed. Until patching is verified, the most effective compensating controls target the network reachability the attack requires: restrict access to the OID LDAP/LDAPS listeners (commonly TCP 389 and 636) with firewall rules or network ACLs so only known application and administration hosts can connect, accepting the trade-off that dependent applications or remote administration sessions using other paths will fail until rules are updated. Tighten LDAP bind and directory ACL configurations so that non-administrative principals have the minimum read and write access to entries, understanding that the CVSS vector already assumes a low-privileged attacker and this only reduces blast radius rather than removing the exposure. Enable and centralize OID audit/logging of binds, searches and modifications and alert on anomalous or high-volume LDAP activity, accepting the storage and performance cost of increased logging. Finally, segment the directory server from unrelated workloads and review what trusts it for authentication, since the scope-change rating means a compromised OID can cascade into dependent products.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Internet Directory is the LDAPv3-compliant directory server shipped as part of Oracle Fusion Middleware; it stores identity and credential data and is typically consumed by Oracle Access Manager, WebLogic, and enterprise applications acting as LDAP clients, which is why a compromise of the directory can propagate to those consumers (consistent with the S:C scope-change rating). The affected component is the OID LDAP Server, meaning the exposure path is the LDAP listener itself, reachable over the network, and the CVSS vector requires only PR:L - a low-privileged, authenticated directory principal - rather than administrative credentials. No CWE was provided in the source data, so the precise root-cause class (for example improper access control, injection, or deserialization within the LDAP request handling path) cannot be confirmed from available intelligence; the authoritative detail lives in Oracle's Fusion Middleware security alert. The combination of AC:L, UI:N, and S:C with high CIA impact describes a path from a modest foothold in the directory to control of the directory service and, by extension, of systems that trust it for authentication and authorization decisions.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Internet Directory. While the vulnerability is in Oracle Internet Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 carry a critical takeover vulnerability that lets a low-privileged, network-positioned attacker gain full control of the directory, and no vendor patch is available yet. Because Oracle Internet Directory typically serves as the identity and authentication backbone for downstream Oracle applications, a single compromised directory could cascade into widespread identity compromise across the enterprise. The risk today is driven by the size of the exposed LDAP attack surface rather than confirmed active exploitation, though leadership should treat this as an enterprise identity risk requiring near-term containment.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to OID LDAP listeners (389/636 and administrative ports) to trusted application hosts only via firewall or segmentation rules; disable anonymous binds and remove unnecessary low-privileged LDAP accounts; enforce least privilege and credential rotation for directory service accounts; require TLS/LDAPS for all directory traffic; and enable detailed bind and audit logging with alerting for anomalous low-privileged directory activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB