CVE-2026-83057

Received Received - Intake

Oracle Internet Directory Remote Code Execution

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Internet Directory. While the vulnerability is in Oracle Internet Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83057

EUVD

EUVD-2026-79385

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	internet_directory	12.2.1.4.0
oracle	internet_directory	14.1.2.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Internet Directory, a component of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The issue allows a low-privileged attacker with network access via LDAP to compromise the system. Successful exploitation can lead to a full takeover of Oracle Internet Directory.

Detection Guidance

This vulnerability affects Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0. Detection requires checking installed versions of Oracle Internet Directory and verifying if LDAP services are exposed to untrusted networks. Use commands like 'ldapsearch -H ldap://<host>:<port> -x' to test LDAP connectivity and 'opatch lsinventory' to check Oracle patch levels.

Impact Analysis

An attacker could gain control of Oracle Internet Directory, potentially leading to unauthorized access, data breaches, or disruption of services. Since attacks may impact additional products, the impact could extend beyond the directory itself.

Compliance Impact

This vulnerability allows low-privileged attackers to compromise Oracle Internet Directory, potentially leading to unauthorized access, data breaches, or system takeover. Such impacts could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Apply the latest security patches from Oracle for affected versions 12.2.1.4.0 and 14.1.2.1.0. Monitor Oracle's security advisories for updates and restrict network access to LDAP services to trusted sources only.

Hi! I’m here to help you understand CVE-2026-83057. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70