Oracle Virtual Directory EUVD-2026-61340

Exploitation requires a valid account with low-privileged LDAP access to the Oracle Virtual Directory Server - confirmed by the CVSS PR:L metric. The attacker must have network connectivity to the LDAP service, but no special network position beyond basic reachability is required (AV:N/AC:L). No user interaction is required (UI:N). The attack is limited to Oracle Virtual Directory versions 12.2.1.4.0 and 14.1.2.0.0; environments on other versions or that have applied the August 2026 CPU patch are not affected. Key limiting factors are: (1) a valid LDAP credential at minimum low-privilege level is mandatory, excluding fully anonymous or internet-opportunistic exploitation; (2) firewall restrictions on the LDAP port materially constrain the attacker's ability to reach the service. Environments that expose Oracle Virtual Directory LDAP directly to internal corporate networks with broad credential issuance represent the highest-risk deployment pattern.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8 and is internally consistent with Oracle's own 'easily exploitable' classification - low attack complexity, no user interaction, and full CIA impact represent a genuine high-severity risk. The low-privilege requirement (PR:L) is the primary mitigating factor: a valid LDAP account is necessary, which excludes fully unauthenticated internet-facing attacks but does not significantly constrain insiders, compromised service accounts, or attackers who have phished or brute-forced credentials. The vulnerability is not in the CISA KEV catalog and no EPSS score is available in the provided data, so exploitation likelihood in the wild cannot be quantitatively assessed. The 'Information Disclosure' tag in the source intelligence materially understates the CVSS-indicated impact, which includes integrity and availability compromise equivalent to full system takeover - security teams should rely on the CVSS vector, not the tag, for triage. The absence of a CWE assignment is a data gap that limits root cause analysis and makes patch-equivalency assessments harder. Overall, this is a genuine priority for organizations running the affected versions in network-accessible configurations.

An attacker with a valid low-privileged LDAP account - such as a standard directory user, a compromised service account, or an insider - connects directly to the Oracle Virtual Directory Server's LDAP port over the network and sends a specially crafted LDAP request targeting the vulnerable component. The server processes the malformed request and allows the attacker to escalate beyond their intended privilege level, resulting in full control over the Oracle Virtual Directory instance, including access to aggregated identity data across all backend sources and the ability to disrupt the directory service. No public proof-of-concept exploit code has been identified at time of analysis.