This vulnerability affects Oracle Internet Directory (OID) components of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via LDAP to exploit the flaw easily, resulting in a complete compromise of the OID service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be performed remotely, causing high confidentiality, integrity, and availability impacts. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to full takeover of Oracle Internet Directory, compromising confidentiality, integrity, and availability of the affected system. This could allow attackers to manipulate directory data, disrupt services, and potentially escalate further within the environment.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 should apply the relevant patches immediately. Oracle strongly advises remaining on actively supported versions and applying security patches promptly to mitigate this and other vulnerabilities. Patch status is confirmed as available via the official Oracle advisory.