CVE-2026-83056

A critical vulnerability in the OID LDAP Server component of Oracle Internet Directory, part of Oracle Fusion Middleware, allows a low-privileged attacker with network access via LDAP to fully compromise the Oracle Internet Directory deployment. The flaw is rated as easily exploitable, requires only an authenticated low-privilege LDAP connection and no user interaction, and carries a scope change, meaning successful attacks can significantly impact additional products beyond Oracle Internet Directory itself. Successful exploitation results in a complete takeover of the directory service with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 9.9). The affected versions are Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0. No public proof-of-concept exists and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, so no exploitation in the wild is currently known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83056 to Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 as soon as it is available for your release track. In the interim, restrict LDAP network access to trusted clients and VPN ranges, audit and lock down low-privilege bind and service accounts, and monitor LDAP logs for anomalous authenticated activity. Because of the scope change, also review integrated Fusion Middleware products that trust OID for authentication.