Oracle Internet Directory EUVD-2026-61343

The only prerequisite is network reachability to the OID LDAP Server (typically TCP 3060/3061) on an affected instance running Oracle Internet Directory 12.2.1.4.0 or 14.1.2.1.0 - no authentication, no user interaction, and no non-default configuration is required per the CVSS vector AV:N/AC:L/PR:N/UI:N. The primary limiting factor is exposure of the LDAP port: deployments that keep OID on an isolated internal segment unreachable from attacker-controlled networks substantially raise the bar, and only the two named supported versions are stated as affected, so environments on other patch levels should confirm applicability with Oracle.

The signals point to a genuine high-priority issue: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates trivially exploitable, remote, unauthenticated compromise with full impact across all three security properties, and Oracle explicitly describes the outcome as 'takeover.' No EPSS score, SSVC decision, or KEV entry was provided in the intelligence, and no public POC is identified, so the maturity of real-world exploitation is currently unknown rather than confirmed - meaning severity is high but observed exploitation is unproven. There is a minor conflict worth noting: the supplied tag labels this 'Information Disclosure,' yet the CVSS shows I:H and A:H and Oracle states full takeover, so treat the tag as incomplete and rely on the vendor's takeover language. Because OID sits at the identity core of Fusion Middleware deployments, any operator running the affected versions - even a mid-sized enterprise IT team with a single OID instance - should treat this as urgent and patch on Oracle's CPU cadence rather than waiting for exploit confirmation.

An attacker with network access to the OID LDAP listener sends a crafted LDAP request to the exposed OID LDAP Server without needing any credentials, exploiting the flaw to gain control of the directory. Once the directory is compromised, the attacker can read, alter, or destroy identity and authorization data used across dependent Fusion Middleware applications. No public POC has been identified at time of analysis, so an attacker would need to develop the exploit independently.