CVE-2026-83060

CVE-2026-83060 is a critical (CVSS 9.8) vulnerability in the OID LDAP Server component of Oracle Internet Directory, part of Oracle Fusion Middleware. An unauthenticated attacker who can reach the LDAP service over the network can exploit it easily and without user interaction, and a successful attack results in complete takeover of the Oracle Internet Directory instance, with high impact on confidentiality, integrity, and availability. Affected deployments are those running the supported versions 12.2.1.4.0 or 14.1.2.1.0. Because OID typically serves as an enterprise identity and directory backend, a compromise could cascade into broader authentication and access-control abuse across dependent systems. There is no known public proof-of-concept and the flaw is not on the CISA Known Exploited Vulnerabilities list, so exploitation in the wild is not currently evidenced.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83060 to all Oracle Internet Directory instances on 12.2.1.4.0 or 14.1.2.1.0 as a top priority. Until patched, restrict network access to the OID LDAP ports (389/636 and any admin listeners) to trusted sources only via firewall or ACLs. Review LDAP authentication and directory logs for anomalous or unauthenticated activity indicative of compromise.