This vulnerability affects Oracle Internet Directory, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It allows an attacker with high privileges and network access via LDAP to compromise the directory service, potentially resulting in complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update, which contains numerous security patches across multiple products.

The vulnerability enables a high privileged attacker with network access via LDAP to fully compromise Oracle Internet Directory, impacting confidentiality, integrity, and availability of the system. This can lead to unauthorized access, data manipulation, and service disruption within the affected Oracle Internet Directory instances.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle emphasizes remaining on actively-supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed as available via the official Oracle advisory.