This vulnerability affects the Oracle Internet Directory component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by unauthenticated attackers over the network via LDAP, allowing complete takeover of the Oracle Internet Directory. Due to the integration of Oracle Internet Directory with other Oracle products, exploitation may have broader impacts beyond the directory itself. The vulnerability is rated critical with a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple Oracle products.

Successful exploitation results in full compromise of Oracle Internet Directory, impacting confidentiality, integrity, and availability. The vulnerability allows unauthenticated remote attackers to take over the directory service, which may lead to further compromise of additional Oracle products relying on it. This represents a critical security risk for affected environments.

Oracle has released official patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends staying on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are indicated in the vendor advisory.