SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-61241 2026-08-18

CVE-2026-61241: Unauthenticated LDAP Takeover of Oracle Internet Directory (CVSS 10.0)

"Oracle disclosed a maximum-severity flaw in the Oracle Internet Directory LDAP server that lets an unauthenticated network attacker fully take over the directory, with impact that Oracle says may extend to other…"

Oracle disclosed a maximum-severity flaw in the Oracle Internet Directory LDAP server that lets an unauthenticated network attacker fully take over the directory, with impact that Oracle says may extend to other products.

What Is It

CVE-2026-61241 is a vulnerability in the OID LDAP Server component of Oracle Internet Directory, part of Oracle Fusion Middleware. Per Oracle's description, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via LDAP to compromise Oracle Internet Directory. Successful attacks result in complete takeover of the product.

The CVSS 3.1 base score is 10.0 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Every exploitability metric is at its worst value: network attack vector, low complexity, no privileges, no user interaction; an exploitability subscore of 3.9. Impact is high across confidentiality, integrity, and availability.

Why It Matters

Two details push this beyond a routine critical. First, the scope is Changed (S:C): Oracle explicitly notes that while the vulnerability lives in Oracle Internet Directory, attacks "may significantly impact additional products." Oracle does not enumerate which products or under what conditions, so defenders should treat spillover beyond the directory service as possible rather than assured, and scope their exposure assessment accordingly.

Second, OID is an identity infrastructure component. A full takeover of an LDAP directory hands an attacker the authentication and authorization substrate that dependent Fusion Middleware applications trust. Combined with the pre-authentication, low-complexity profile, this is the class of bug that requires no foothold and no user error to trigger.

CVE-2026-61241 does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing, so active exploitation is not confirmed at this time. Defenders should re-check the catalog directly (linked in Sources) rather than treating this as a durable status. The record was published 2026-08-18 with a vulnerability status of "Received," meaning NVD analysis is still pending.

What's Vulnerable

No CPE data has been assigned yet.

Patch Status

The patch vehicle for this CVE is not yet confirmed. The single reference supplied by the CNA ([email protected]) points to an Oracle security alert page dated August 2026, which implies a fix exists, but two things about that reference warrant caution before you plan remediation around it.

First, Oracle ships Critical Patch Updates on a fixed quarterly schedule: January, April, July, and October. There is no August CPU cycle. An August 2026 advisory would therefore be an out-of-band Security Alert rather than a Critical Patch Update; a distinction that matters, because Security Alerts and CPUs are indexed and bundled differently, and an admin searching for an "August CPU" will not find one.

Second, the supplied link's filename (cspuaug2026.html) does not follow Oracle's usual naming convention for either vehicle (cpu<month><year>.html for Critical Patch Updates, alert-cve-<id>.html for Security Alerts), so it may not resolve. If it fails, navigate to the advisory from Oracle's Security Alerts index rather than assuming no fix was published.

No specific fixed version numbers, workarounds, or required-action deadlines are stated in the CNA-supplied data. Administrators should consult Oracle's Security Alerts index directly to identify the correct advisory and its patch mapping against 12.2.1.4.0 and 14.1.2.1.0 deployments.

Sources