This vulnerability affects Oracle Internet Directory components in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It permits an unauthenticated attacker with network access via LDAP to compromise the directory server, resulting in a full takeover of Oracle Internet Directory. The vulnerability's scope change means that exploitation may affect other Oracle products relying on this directory. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for it. Users are advised to review the advisory and apply relevant patches promptly.

An unauthenticated attacker with network access via LDAP can fully compromise Oracle Internet Directory, leading to complete takeover of the directory service. This can result in severe confidentiality, integrity, and availability impacts. Additionally, because Oracle Internet Directory is used by other Oracle products, exploitation may have a wider impact beyond the directory itself.

Oracle has published a Critical Security Patch Update advisory in August 2026 that addresses this vulnerability among many others. However, the advisory does not explicitly confirm the availability of a specific patch or remediation level for CVE-2026-61241. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.