Oracle Internet Directory CVE-2026-83060

No special conditions - remote unauthenticated exploitation over the LDAP protocol against the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0. The attacker needs only network access to the OID LDAP listener (default 389/636); no credentials, no user interaction, and no non-default configuration are required (PR:N/UI:N/AC:L). The primary limiting factor is network exposure: OID LDAP ports are frequently restricted to internal/management networks, so internet-facing exposure is the main variable determining real-world reachability. Applies only to the two named versions.

This is a genuine top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) is internally consistent with the description: an unauthenticated, network-adjacent attacker exploits the OID LDAP Server over LDAP with low complexity, no privileges, and no user interaction, achieving full compromise (takeover) with high confidentiality, integrity, and availability impact. CWE-287 (Improper Authentication) plus the 'Authentication Bypass' tag corroborate the pre-auth nature, so the signals are mutually reinforcing rather than conflicting. However, the corroborating exploitation signals are entirely absent: no EPSS score, no CISA KEV listing, and no public POC were provided. Oracle's advisory (cspusep2026) is a Critical Patch Update rollup that publishes zero technical detail, so scoring rests solely on Oracle's own reporting. Net assessment: treat as high priority for patching because it is a pre-auth full-takeover flaw in an identity/directory server (a high-value target whose compromise cascades to everything it authenticates), but note there is currently NO evidence of exploitation in the wild - the urgency is driven by impact and exploitability, not by observed attacks.

An attacker with network reachability to the OID LDAP Server port (typically 389/636) sends crafted LDAP traffic that bypasses authentication, requiring no credentials and no user interaction. Because Oracle Internet Directory is the enterprise identity store, successful takeover lets the attacker read, alter, or destroy directory data and pivot to any downstream service relying on OID for authentication. No public exploit code has been identified at time of analysis, so exploitation would currently require original research.