Oracle Internet Directory EUVD-2026-79386

Requires network access to the Oracle Internet Directory LDAP Server and low-level authenticated privileges (PR:L) - i.e., the attacker must already hold at least a minimal LDAP bind/credential to the directory, so this is not a pure unauthenticated attack. Affected deployments are OID versions 12.2.1.4.0 and 14.1.2.1.0. No user interaction and no non-default feature toggle is described. The key limiting factors are the low-privilege authentication requirement and network reachability of the LDAP service; environments that restrict LDAP exposure to trusted management networks and enforce strong bind controls materially reduce realistic risk, while the scope change means a successful compromise can propagate to other Fusion Middleware products that depend on OID for identity.

CVSS 3.1 base score is 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H: network-reachable, low attack complexity, only low privileges required, no user interaction, a scope change, and full confidentiality/integrity/availability impact culminating in takeover of Oracle Internet Directory. This is a well-calibrated score - the PR:L and S:C metrics honestly reflect that the attacker needs some authenticated LDAP foothold but that successful attack breaks out of OID to impact additional products. However, real-world exploitation signals are entirely absent: there is no CISA KEV listing, no public POC identified, and no EPSS probability supplied in the input. Oracle's Critical Patch Update (cspusep2026) provides zero technical detail, which is typical for Oracle CPUs and means severity here rests solely on the vendor's own CVSS assessment rather than independent corroboration. The one-notch reduction from a perfect 10.0 is driven entirely by PR:L (an attacker must already possess some low-privilege LDAP credential/bind), which is a meaningful limiter for a directory service that is usually not exposed unauthenticated to untrusted networks. Net: treat as a genuine high-priority patch for any exposed OID instance because OID is an identity/authentication backbone and compromise cascades (scope change), but note this is currently a high-CVSS-with-no-observed-exploitation issue - prioritize based on exposure of the LDAP service rather than evidence of active attack. The 'Information Disclosure' tag understates the vulnerability: the vector is a full C:H/I:H/A:H takeover, not disclosure-only.

A low-privileged attacker who can reach the OID LDAP Server over the network and hold even a minimal directory bind sends crafted LDAP operations that exploit the flaw to escalate to full control of Oracle Internet Directory. Because of the scope change, the compromise extends beyond OID into other Fusion Middleware products that rely on it for identity and authentication. No public exploit code has been identified at time of analysis, and no user interaction is required.