Oracle disclosed a critical vulnerability in the Oracle Internet Directory LDAP server that lets a low-privileged network attacker take over the directory and reach beyond it into adjacent products.
What Is It
CVE-2026-61248 is a vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware, specifically in the OID LDAP Server component. Oracle describes it as easily exploitable: an attacker with low privileges and network access via LDAP can compromise Oracle Internet Directory outright. Successful exploitation results in full takeover of the directory.
The flaw carries a CVSS 3.1 base score of 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low attack complexity, no user interaction, and high impact to confidentiality, integrity, and availability.
Why It Matters
The scope is marked as changed. Oracle notes that while the vulnerability lives in Oracle Internet Directory, attacks may significantly impact additional products. That is the core of the risk: OID is a directory service, and a takeover does not stay contained to the directory itself.
The privilege bar is low rather than none, an attacker needs some level of access, but combined with low attack complexity and no user interaction requirement, the exploitation barrier is minimal for anyone who already has a foothold or valid low-privilege credentials.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time. The NVD record was published 2026-08-18 and remains in "Received" status, meaning NVD analysis is not yet complete.
What's Vulnerable
Oracle Internet Directory (Oracle Fusion Middleware), supported versions:
- 12.2.1.4.0
- 14.1.2.1.0
The affected component is the OID LDAP Server. No CPE data was available in the NVD record at time of publication.
Patch Status
The CVE was assigned by Oracle as CNA, with [email protected] listed as the assigner contact; the supplied data does not identify who reported the flaw.
Fixes for Fusion Middleware are delivered through Oracle's Critical Patch Update program, but the specific Critical Patch Update carrying the fix for CVE-2026-61248 could not be confirmed from the supplied source material, and the Oracle advisory URL in the record has not been verified against a published Oracle advisory. Administrators running the affected versions should work from Oracle's Critical Patch Update landing page and the most recent advisory published there rather than relying on the link below, and apply the corresponding Fusion Middleware patches. No specific remediation deadline or required-action directive is present in the supplied source material.
Sources
- NVD, CVE-2026-61248: https://nvd.nist.gov/vuln/detail/CVE-2026-61248
- Oracle Critical Patch Update advisory reference (URL as supplied; unverified): https://www.oracle.com/security-alerts/cspuaug2026.html