This vulnerability affects the Oracle Internet Directory component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It allows an attacker with low privileges and network access via LDAP to compromise Oracle Internet Directory. The vulnerability is easily exploitable and can result in complete takeover of the Oracle Internet Directory. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle’s August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 other patches. Oracle strongly recommends applying patches promptly to mitigate exploitation risks.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Internet Directory, impacting confidentiality, integrity, and availability. Due to scope change, other Oracle products relying on Oracle Internet Directory may also be significantly affected. The vulnerability is rated critical with a CVSS score of 9.9.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the official patches without delay to mitigate the risk. Oracle recommends remaining on actively supported versions and promptly applying security patches. No alternative mitigations or temporary fixes are indicated in the advisory.