EUVD-2026-79387
GHSA-gm73-mp37-g5cv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network LDAP attack vector, no privileges or interaction, scope change with full confidentiality, integrity, and availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Internet Directory. While the vulnerability is in Oracle Internet Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Takeover of Oracle Internet Directory via its LDAP server component allows unauthenticated remote attackers to fully compromise the directory service. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 when the OID LDAP Server is reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 rates this 10.0 critical with network attack vector, low complexity, no privileges, and no user interaction, meaning a remotely reachable LDAP interface is highly susceptible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update referenced in the vendor advisory at https://www.oracle.com/security-alerts/cspusep2026.html; the exact patched version is not specified in the provided data, so confirm the appropriate release with Oracle. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today