CVE-2026-83066 in Internet Directory
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Internet Directory. Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Oracle Internet Directory component within the Oracle Fusion Middleware suite is susceptible to a critical remote code execution vulnerability that allows unauthenticated attackers to gain complete control over the affected system. This flaw resides specifically in the OID LDAP Server, which serves as a central directory service for managing user identities and access policies across enterprise environments. The supported versions 12.2.1.4.0 and 14.1.2.1.0 are confirmed to be vulnerable, indicating that this issue persists even in relatively recent releases of the middleware stack. The severity of this vulnerability is underscored by a CVSS 3.1 Base Score of 9.8, which classifies it as critical due to its high impact on confidentiality, integrity, and availability.
The technical nature of this flaw permits exploitation via network-accessible protocols such as T3 and IIOP without requiring any form of authentication or user interaction. This characteristic significantly lowers the barrier for entry, allowing a remote attacker with basic network connectivity to initiate an attack from anywhere within reach of the target system's port exposure. The absence of required privileges means that even low-skilled threat actors can leverage this vulnerability, while high-skilled attackers could potentially use it as a foothold for more complex lateral movement or persistent access strategies.
Successful exploitation results in the complete takeover of Oracle Internet Directory, granting the attacker administrative-level control over the directory service. This level of compromise is particularly dangerous because OID often stores sensitive authentication credentials and security policies that govern access to other critical systems within an organization's infrastructure. By compromising this central repository, attackers can manipulate user accounts, alter authorization rules, or extract confidential data such as password hashes and personal identifiable information. The ability to modify integrity-related attributes also allows for the creation of backdoor accounts or the disabling of security controls, effectively neutralizing defensive measures put in place by system administrators.
From a classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-94, Code Injection, depending on the specific mechanism used to achieve remote code execution via the T3 or IIOP protocols. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1068, Exploitation for Privilege Escalation, and potentially T1190, Exploit Public-Facing Application, given its network accessibility and lack of authentication requirements. The high availability impact also suggests potential denial-of-service capabilities if the exploitation process destabilizes the LDAP service, further disrupting business operations that rely on directory services for single sign-on or identity management workflows.
Mitigation strategies must prioritize immediate isolation of affected systems from untrusted networks until patches are applied. Oracle has likely released security updates addressing this specific flaw in subsequent patch sets for versions 12.2.1 and 14.1.2, so applying the latest available CPU is the primary remediation step. In environments where patching cannot be implemented immediately due to operational constraints, network segmentation should be enforced to restrict access to T3 and IIOP ports exclusively from trusted internal subnets. Additionally, deploying intrusion detection systems with signatures tailored to detect anomalous LDAP traffic patterns or known exploit payloads can provide an additional layer of defense against active exploitation attempts. Regular auditing of directory service configurations and monitoring for unusual authentication failures or privilege changes are also recommended to identify potential compromise early in the kill chain.