Oracle Internet Directory EUVD-2026-79389

No special conditions - remote unauthenticated exploitation over the network against the OID LDAP Server component of Oracle Internet Directory (versions 12.2.1.4.0 and 14.1.2.1.0). Exploitation requires only network access to the LDAP service (default listener); Oracle describes it as 'easily exploitable' with no authentication (PR:N), no user interaction (UI:N), and no special configuration. The primary limiting factor is network exposure of the OID LDAP port - organizations that restrict LDAP access to trusted management segments materially reduce reachability. No known public exploit code exists at time of analysis.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is internally consistent and well-calibrated: the Oracle description explicitly states an unauthenticated attacker with network access via LDAP can 'easily' exploit it (matching AC:L/PR:N) to achieve full takeover of Oracle Internet Directory (matching C:H/I:H/A:H). CWE-287 (Improper Authentication) aligns with the 'Authentication Bypass' tag. The dynamic exploitation signals, however, are all absent: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so this is 'no public exploit identified at time of analysis' - not active exploitation. No SSVC decision data was supplied. The result is a high-severity, high-plausibility issue (pre-auth compromise of a core identity/directory service) that is not yet known to be exploited in the wild; the gap between a 9.8 base score and empty threat-intel signals suggests it should be patched promptly but is not (yet) evidence of mass exploitation. As is typical of Oracle CPU entries, the advisory provides zero technical detail, so the exact flaw and affected code path cannot be independently confirmed.

An attacker with network reachability to the OID LDAP Server port sends a crafted LDAP request that abuses the improper authentication flaw, without supplying any valid credentials. This grants full compromise (read, modify, and denial) of the Oracle Internet Directory, which as an enterprise identity store can cascade into broader authentication and directory abuse. No public exploit code has been identified at time of analysis.