Oracle Internet Directory EUVD-2026-79383

Requires network access to the Oracle Internet Directory LDAP Server (the OID LDAP Server component) and a low-privileged authenticated context (PR:L), so the attacker needs some valid credential or authenticated LDAP session rather than fully anonymous access. Affected deployments are Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0. The key aggravating factor is the scope change: because OID is a central identity/directory service, a successful attack 'may significantly impact additional products' that depend on it. Limiting factors: exploitation is not fully unauthenticated (PR:L), requiring at least minimal directory privileges, and no user interaction is needed (UI:N); no non-default feature toggle is documented, but the exact LDAP operation and any configuration prerequisites are not disclosed in the Oracle CPU.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The vendor CVSS of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is well-calibrated: it honestly reflects the low-privilege prerequisite (PR:L) and scope change (S:C) rather than inflating to a perfect 10.0, and the scope change plus full C/I/A triad indicating takeover of a central identity directory is a serious combination. Because Oracle Internet Directory is an LDAP directory that other Fusion Middleware and enterprise applications authenticate against, the S:C rating is credible - compromise cascades into every product that trusts it. However, several exploitation-likelihood signals are absent: there is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Oracle CPU entries are characteristically detail-free (the only reference is the September 2026 CPU landing page), so the technical root cause and attack primitive are unconfirmed. Net: treat as a priority patch given the criticality of the affected identity service and low attack complexity, while recognizing that no active exploitation or weaponization is currently evidenced.

A low-privileged attacker with a valid (possibly minimal) directory account or network-reachable LDAP access sends crafted LDAP requests to the OID LDAP Server. Successful exploitation compromises Oracle Internet Directory entirely and, via the scope change, impacts additional products that rely on it for authentication and identity. No public proof-of-concept is identified in the available data.