Internet Directory
Monthly
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the LDAP service over the network can take over the directory instance. The flaw scores CVSS 9.8 with high confidentiality, integrity, and availability impact and is addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle Internet Directory (OID) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access over LDAP to fully compromise the directory server, with a scope change that can significantly impact other products relying on it. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact, it was reported by Oracle and addressed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Internet Directory (OID) is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 through its OID LDAP Server component, where an unauthenticated remote attacker with LDAP network access can fully compromise the directory service. Rated CVSS 10.0 with a scope change (S:C), successful exploitation can pivot beyond OID to significantly impact additional products that depend on it. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximum severity and identity-infrastructure role make this a top-priority patch.
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available.
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Internet Directory component of Oracle Fusion Middleware (subcomponent: Oracle Directory Services Manager). Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable.
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the LDAP service over the network can take over the directory instance. The flaw scores CVSS 9.8 with high confidentiality, integrity, and availability impact and is addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle Internet Directory (OID) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access over LDAP to fully compromise the directory server, with a scope change that can significantly impact other products relying on it. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact, it was reported by Oracle and addressed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Internet Directory (OID) is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 through its OID LDAP Server component, where an unauthenticated remote attacker with LDAP network access can fully compromise the directory service. Rated CVSS 10.0 with a scope change (S:C), successful exploitation can pivot beyond OID to significantly impact additional products that depend on it. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximum severity and identity-infrastructure role make this a top-priority patch.
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available.
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Internet Directory component of Oracle Fusion Middleware (subcomponent: Oracle Directory Services Manager). Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable.