CVE-2026-83058

CVE-2026-83058 is a critical (CVSS 9.9) vulnerability in the OID LDAP Server component of Oracle Internet Directory, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.1.0. A remote attacker with only low-privileged network access via LDAP can exploit it easily (no user interaction required), and because of a scope change, a successful attack can also significantly impact additional products beyond Oracle Internet Directory itself. Successful exploitation results in complete takeover of Oracle Internet Directory, with high impact on confidentiality, integrity, and availability of the directory service and the identity data it holds. Organizations running the affected OID versions as their LDAP/identity backbone are the primary victims, with downstream impact possible for any applications relying on the directory for authentication. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild is currently known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83058 to affected 12.2.1.4.0 and 14.1.2.1.0 deployments as soon as possible. Restrict LDAP (389/636 and admin ports) to trusted networks and VPNs, and tightly audit or prune low-privileged LDAP bind accounts that could serve as the entry point. Review directory logs for anomalous modifications, privilege changes, or new administrative entries on OID instances, and assess dependent applications given the potential scope change.