CVE-2026-83061

CVE-2026-83061 is a critical (CVSS 9.8) vulnerability in the OID LDAP Server component of Oracle Internet Directory, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated remote attacker who can reach the LDAP service over the network can exploit the flaw with low complexity, requiring no privileges or user interaction. A successful attack can result in complete takeover of Oracle Internet Directory, with high impact on confidentiality, integrity, and availability of the directory service. Because OID often stores and authenticates enterprise identity data, compromise could cascade into broader access to dependent applications and middleware. The flaw is not currently listed in CISA's KEV catalog and no public proof-of-concept is known, but Oracle's track record of similar directory-service bugs makes patching urgent.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83061 to all Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 installations. Until patched, restrict network access to LDAP ports (typically 389/636) to only trusted clients and management hosts, and consider blocking internet-facing exposure entirely. Review OID logs for unexplained binds, schema or administrative changes, and replication anomalies that could indicate compromise.