This vulnerability affects Oracle Virtual Directory in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access via LDAP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 score of 9.8 reflects critical impacts on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying these patches without delay. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but can affect application functionality.

Successful exploitation allows an unauthenticated attacker with network access via LDAP to fully compromise Oracle Virtual Directory, leading to complete takeover of the product. This impacts confidentiality, integrity, and availability of the affected system, posing a critical security risk.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches promptly to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack or by removing unnecessary privileges from users. However, these mitigations may disrupt normal application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory: a fix is available via the June 2026 Critical Security Patch Update.