Oracle Internet Directory EUVD-2026-79387

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 when the OID LDAP Server is reachable over the network. Exploitation requires access to the LDAP service, typically on TCP 389 or 636, but does not require authentication or user interaction. The limiting factor is exposure: deployments where LDAP is restricted to trusted internal networks are less exposed than internet-facing configurations.

CVSS 3.1 rates this 10.0 critical with network attack vector, low complexity, no privileges, and no user interaction, meaning a remotely reachable LDAP interface is highly susceptible. However, EPSS exploitation probability and KEV status are not provided, so real-world exploitation prevalence cannot be confirmed. No POC is identified in the supplied references. SSVC assessment would classify technical impact as total, but exploitation and automatable statuses remain unknown due to missing KEV and POC data. For internet-exposed Oracle Internet Directory LDAP services this is a high urgency patching priority; for LDAP restricted to trusted internal networks, practical risk is lower.

An attacker sends crafted LDAP requests to an internet-facing Oracle Internet Directory LDAP server. The authentication bypass in the LDAP component gives the attacker control over the directory service without credentials. The resulting scope change can then impact additional connected systems relying on the compromised directory.