This vulnerability affects Oracle Internet Directory, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via LDAP can exploit this flaw to take over Oracle Internet Directory. The vulnerability has a CVSS 3.1 score of 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating it is remotely exploitable without privileges or user interaction and results in complete confidentiality, integrity, and availability compromise. The scope of impact extends beyond Oracle Internet Directory to other Oracle products. Oracle has included fixes for this vulnerability in its August 2026 Critical Security Patch Update.

Successful exploitation allows an unauthenticated remote attacker to fully compromise Oracle Internet Directory, leading to complete loss of confidentiality, integrity, and availability of the affected system. The compromise may also affect additional Oracle products due to scope change. This can result in takeover of Oracle Internet Directory and potentially broader impacts within Oracle environments.

Oracle has released security patches for this vulnerability in the August 2026 Critical Security Patch Update. It is strongly recommended that customers apply these patches promptly to mitigate the risk. Oracle advises remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.