CVE-2026-83063 is a vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware, specifically in the OID LDAP Server component. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows a high privileged attacker with network access via LDAP to compromise Oracle Internet Directory, potentially leading to full takeover. The CVSS 3.1 base score is 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. Oracle’s September 2026 Critical Security Patch Update includes patches for this vulnerability along with many others across multiple products.

Successful exploitation of this vulnerability can result in complete compromise of Oracle Internet Directory, affecting confidentiality, integrity, and availability of the service. This can lead to unauthorized access and control over the directory service, which is critical for identity and access management within Oracle Fusion Middleware environments.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 without delay. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to mitigate exploitation risks. No alternative mitigations or temporary fixes are indicated in the advisory.