Oracle Internet Directory EUVD-2026-79390

No special conditions - remote unauthenticated exploitation over the network via the LDAP protocol against the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0. The attacker needs only network access to the LDAP listener; no credentials (PR:N), no user interaction (UI:N), and no non-default configuration are required per the CVSS vector and Oracle's 'easily exploitable' characterization. The primary limiting factor is network exposure of the OID LDAP port - directory servers are typically deployed on internal/segmented networks rather than internet-facing, which constrains the realistic attacker population; the exact vulnerable configuration and root cause are undisclosed.

All signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a remote, unauthenticated, low-complexity attack requiring no user interaction that yields full compromise of confidentiality, integrity, and availability - the Oracle description explicitly states 'takeover of Oracle Internet Directory.' The vector is internally consistent with the CWE-287 (Improper Authentication) classification and the 'Authentication Bypass' tag, so there is no CVSS-versus-description conflict here. Tempering the raw score: no EPSS probability is supplied, this CVE is NOT on the CISA KEV list, and no public POC has been identified, so exploitation status is 'no public exploit identified at time of analysis' - real-world exploitation is currently theoretical rather than observed. As is standard for Oracle Critical Patch Update entries, the advisory (cspusep2026) provides zero technical root-cause detail, so severity rests entirely on Oracle's self-reported CVSS. This is a real priority to patch given the pre-auth network-facing LDAP takeover profile and OID's role as an identity/directory store, but the absence of KEV/POC/EPSS means it should be treated as high-urgency-to-remediate rather than under-active-mass-exploitation.

An unauthenticated attacker with network reachability to the OID LDAP Server port sends crafted LDAP traffic that bypasses authentication and compromises the directory service, resulting in full takeover of Oracle Internet Directory and the identity data it holds. No user interaction or prior credentials are required. No public proof-of-concept or exploit code has been identified at the time of analysis.