Oracle Virtual Directory EUVD-2026-37438

Attacker needs TCP reachability to the Oracle Virtual Directory Server LDAP/LDAPS listener (default 389/636) on an instance running Oracle Virtual Directory 12.2.1.4.0 or 14.1.2.0.0 within Oracle Fusion Middleware; no credentials, user interaction, or non-default configuration are required per Oracle's CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Exploitation is limited primarily by network exposure of the OVD listener - deployments where OVD is reachable only from a hardened internal identity tier or fronted by an LDAP-aware filtering proxy materially reduce realistic risk, while any instance exposed to broader corporate or untrusted networks is directly reachable. The vulnerability is product-specific: only OVD is named, not other Fusion Middleware directory products such as OID or OUD, so risk is bounded to environments that actually deploy the Virtual Directory component.

All available signals point to high real-world priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity, unauthenticated, no-user-interaction path with full CIA impact, and Oracle explicitly calls it 'easily exploitable.' OVD instances are typically exposed on LDAP/LDAPS (389/636) inside enterprise identity tiers, so any reachable instance is materially at risk. Mitigating factors are that no EPSS score, KEV listing, SSVC decision, or public POC was supplied in the input, so exploitation is currently characterized as no public exploit identified at time of analysis rather than active exploitation; this likely reflects a freshly disclosed Oracle CPU issue rather than a low-risk one. Key data gaps: the CWE is N/A, EPSS and KEV status are not provided, and the only reference is the Oracle CPU advisory page, so independent corroboration of root cause and patched build numbers is limited.

An attacker with TCP reach to an OVD listener (389/636) opens an LDAP session and sends a crafted request - for example a malformed bind, extended operation, or search filter - that triggers the vulnerable code path in the Virtual Directory Server, yielding code execution or full administrative control of the OVD process. From that foothold the attacker pivots into the identity tier: tampering with directory views to escalate privileges in downstream Fusion Middleware applications, harvesting credentials proxied through OVD, or disrupting authentication for dependent services. No public exploit identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N profile means weaponization effort is the main gating factor, not access.