CVE-2026-83055

Oracle Internet Directory's LDAP Server component (part of Oracle Fusion Middleware) contains an easily exploitable vulnerability rated CVSS 3.1 9.9 (CVE-2026-83055). It is triggered when a low-privileged attacker with network access to the LDAP service exploits the flaw, requiring no user interaction. Successful attacks result in complete takeover of Oracle Internet Directory with high impact to confidentiality, integrity, and availability, and — because the CVSS scope is 'changed' — the blast radius can extend to additional products beyond OID itself. Affected deployments are Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0. No public proof-of-concept is known, the CVE is not on CISA's KEV, and no exploitation in the wild has been reported to date.

What to do: Apply Oracle's Critical Patch Update fixes covering CVE-2026-83055 to Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 as soon as they are available. Restrict the OID LDAP listener ports (e.g., 3060/3131, or 389/636) to trusted application and management networks via firewall rules, since exploitation requires network access to LDAP. Audit low-privileged directory accounts for compromise and monitor LDAP logs for anomalous binds, schema/configuration changes, or privilege escalation originating from unprivileged DNs.