EUVD-2026-79394
GHSA-h89f-r8g9-cx4w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OID T3/IIOP listener over network
-
DeliverySend crafted unauthenticated request
-
ExploitBypass authentication (CWE-287)
-
ExecutionAchieve full directory takeover
-
ImpactRead/modify all identity data and disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable remotely and pre-authentication (AV:N/PR:N/UI:N) against Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 where the OID LDAP Server is reachable over the network via the T3 and/or IIOP protocols. The concrete prerequisite is network access to the T3/IIOP listener (WebLogic remoting ports), so exposure is limited primarily by network segmentation - internet-facing or broadly-reachable OID/WebLogic instances are at greatest risk, while directories restricted to trusted management networks are substantially harder to reach. No authentication, no user interaction, and no special non-default feature toggle is indicated by the description. |
| Impact | All signals point to a genuine top-priority vulnerability. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a network-reachable, low-complexity, pre-authentication flaw yielding full compromise (takeover) of Oracle Internet Directory, and CWE-287 (Improper Authentication) is consistent with the 'Authentication Bypass' tag and the 'unauthenticated attacker' language. However, the exploitability signals beyond CVSS are entirely absent from the input: there is NO EPSS score, NO CISA KEV listing, NO public POC, and NO SSVC decision data provided, so exploitation status is 'no public exploit identified at time of analysis.' The Oracle September 2026 CPU (cspusep2026) is the sole primary reference and, per Oracle's standard practice, contains zero technical detail - no root cause, no exploit path. One notable internal inconsistency: the component is named 'OID LDAP Server' yet the attack vector is described as 'via T3, IIOP,' which are WebLogic/Java RMI protocols rather than LDAP - verify the affected listener/port with Oracle. The 9.8 score is well-calibrated for a described pre-auth RCE-class takeover, but treat active-exploitation risk as unproven: prioritize patching based on the severity and the historically high attacker interest in Oracle Fusion Middleware auth bypasses, not on any confirmed in-the-wild activity. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to the Oracle Internet Directory server's T3/IIOP listener sends a crafted request that bypasses authentication, gaining full control over the directory service (read/modify/delete all directory data and disrupt availability). No user interaction or prior credentials are required. No public proof-of-concept is available at the time of analysis; Oracle's advisory provides no technical detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers can achieve full takeover of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by reaching the OID LDAP Server through its exposed T3 or IIOP remoting listeners, requiring no credentials and no user interaction (CVSS 3.1 base score 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication-bypass condition (CWE-287) in the Fusion Middleware OID LDAP Server component, and successful exploitation yields complete loss of confidentiality, integrity and availability across the directory service. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is not confirmed active exploitation; however, the pre-authentication, network-reachable attack path means internet-facing or broadly reachable OID/WebLogic deployments carry the highest risk, while instances confined to trusted management networks are substantially harder to reach because the only real gating factor is network access to the T3/IIOP listener.
RemediationAI
Patch status: Patch available per vendor advisory - Oracle published this issue through its Fusion Middleware security alert (https://www.oracle.com/security-alerts/cspusep2026.html); the provided data does not include an exact fixed build number, so confirm the specific patched release for 12.2.1.4.0 and 14.1.2.1.0 in that advisory and apply it via the standard Oracle Critical Patch Update process for Fusion Middleware/WebLogic, then restart the affected domain. If immediate patching is not possible, the highest-value compensating control is network exposure reduction, because the assessment confirms the only prerequisite is reachability of the T3/IIOP listener: block TCP access to the WebLogic T3 and IIOP listener ports at the perimeter and between security zones, and permit them only from trusted administration hosts. Trade-off: this will break remote WLST, the Administration Console and any remote clients that use T3/IIOP, so trusted management workstations must be explicitly whitelisted. A tighter in-product option is to configure a WebLogic connection filter (for example, the weblogic.security.net.ConnectionFilterImpl network filter) or dedicated network channels so that only named hosts may connect over T3/IIOP; note that a misconfigured filter can lock out administrators and Node Manager communication. If T3 tunneling is not required by any application, disable or restrict T3 in favor of HTTP-based administration, accepting that legacy remote clients will stop working. Finally, move OID instances that do not need external LDAP access behind strict segmentation, and monitor WebLogic/OID logs for anomalous T3 or IIOP connection attempts originating from untrusted sources, treating any such connection as a potential exploitation attempt given the pre-authentication nature of the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Internet Directory is the LDAP directory service shipped as part of Oracle Fusion Middleware, and in the affected 12.2.1.4.0 and 14.1.2.1.0 releases its LDAP server component runs in an Oracle WebLogic Server container that exposes WebLogic's proprietary remoting protocols - T3 (the WebLogic RPC/tunneling protocol) and IIOP (CORBA-based remote invocation) - alongside the LDAP interface. The vulnerability is classified under CWE-287 (Improper Authentication), meaning the OID LDAP Server fails to correctly establish or verify the identity of a remote caller, so an attacker who can open a T3 or IIOP connection to the listener can reach functionality that should be reserved for authenticated administrators. Because T3 and IIOP are unauthenticated at the transport/handshake level and carry serialized Java objects and remote invocations into the server, an authentication-bypass flaw in this surface is both remotely triggerable and directly consequential - it is the standard path by which an unauthenticated peer escalates to full control of the middleware instance hosting OID. The EUVD record (EUVD-2026-79394) mirrors the same two affected versions, and Oracle is the reporting party, consistent with a vendor-internal discovery published through the Fusion Middleware security alert.
Know when Internet Directory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states easily exploitable, unauthenticated, network-reachable via T3/IIOP with full takeover of OID, giving PR:N/AC:L and C:H/I:H/A:H; impact stays within the component so S:U.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Internet Directory. Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical authentication bypass that allows unauthenticated remote attackers to fully compromise the directory service via exposed T3 or IIOP listeners. Because the directory underpins identity and access management, a successful attack could cascade across enterprise applications, leading to widespread credential theft, service disruption, and loss of trust. Leadership should prioritize immediate exposure reduction and contingency planning while awaiting a vendor fix.
No vendor-released patch identified at time of analysis; restrict network access to T3/IIOP listeners to trusted management networks, disable unnecessary remoting services, and monitor for authentication bypass attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Internet Directory
View allTakeover of Oracle Internet Directory via its LDAP server component allows unauthenticated remote attackers to fully com
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2
Complete takeover of Oracle Internet Directory (OID) is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.
Privilege escalation to full takeover in Oracle Internet Directory (OID) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileg
Authentication bypass in Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with netwo
Unauthenticated attackers with network access to the OID LDAP Server component can fully compromise Oracle Internet Dire
Unauthenticated remote takeover of Oracle Internet Directory is achievable through its OID LDAP Server component in vers
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4
Authentication bypass in the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows a r
Vulnerability in the Oracle Internet Directory component of Oracle Fusion Middleware (subcomponent: Oracle Directory Ser
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/serv
Exploit-DB