This vulnerability affects the Oracle Internet Directory component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It permits an unauthenticated attacker with network access via LDAP to exploit the flaw and compromise the directory service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can result in complete confidentiality, integrity, and availability loss. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous patches across Oracle products. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation allows an unauthenticated remote attacker to take over Oracle Internet Directory, leading to full compromise of the service with high confidentiality, integrity, and availability impacts. This can result in unauthorized access, data manipulation, and service disruption.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the provided patches for Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to mitigate this risk. Patch status is confirmed as available via the official Oracle advisory.