This vulnerability affects the Oracle Internet Directory component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via LDAP to compromise the Oracle Internet Directory, potentially leading to complete takeover. The vulnerability also has scope change implications, meaning it can significantly impact other Oracle products dependent on Oracle Internet Directory. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a network attack vector with low attack complexity, requiring low privileges, no user interaction, and resulting in high confidentiality, integrity, and availability impacts with scope change. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability, and Oracle strongly recommends applying these patches promptly.

Successful exploitation of this vulnerability can result in complete compromise of Oracle Internet Directory, including full confidentiality, integrity, and availability loss. Due to the interconnected nature of Oracle products, this compromise may extend to other products relying on Oracle Internet Directory, increasing the overall impact. The vulnerability is rated critical with a CVSS 3.1 base score of 9.9.

Oracle has released security patches for this vulnerability in its September 2026 Critical Security Patch Update. Customers should apply these patches without delay to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches. No alternative mitigations or workarounds are specified in the vendor advisory.