CVE-2026-83059 is a critical vulnerability in the Oracle Internet Directory (OID) LDAP Server component of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows an unauthenticated attacker with network access via LDAP to compromise Oracle Internet Directory, leading to a complete takeover of the service. The vulnerability has a CVSS 3.1 score of 10.0 with network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and high impacts on confidentiality, integrity, and availability. The vulnerability may also affect other Oracle products due to scope change. Oracle has released patches for this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to take over Oracle Internet Directory, resulting in full compromise of confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products relying on Oracle Internet Directory may also be significantly impacted.

Oracle has released patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying patches without delay. No alternative mitigations or temporary fixes are noted in the advisory.