Oracle disclosed a critical, easily exploitable vulnerability in the Oracle Internet Directory LDAP server that lets an unauthenticated remote attacker fully take over the directory.
What Is It
CVE-2026-61258 is a vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware, specifically in the OID LDAP Server component. Per Oracle's advisory, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via LDAP to compromise Oracle Internet Directory. Successful exploitation results in complete takeover of the directory service.
It carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability. The record was published 2026-08-18 with a source identifier of [email protected] and currently sits in NVD Received status.
Why It Matters
Oracle Internet Directory is an LDAP directory; the identity backbone for the environments that deploy it. A takeover of the directory is not a single-service compromise; the impact metrics here are high across all three axes, meaning an attacker can read, modify, and disrupt directory contents. The exploitability subscore is a maximum 3.9, which reflects that there is no authentication barrier and no user interaction required in front of an attacker who can reach the LDAP port.
No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation and no KEV-mandated remediation deadline at this time.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Internet Directory (Oracle Fusion Middleware)
- Component: OID LDAP Server
- Affected supported versions: 12.2.1.4.0 and 14.1.2.1.0
No CPE match data was included in the supplied record.
Patch Status
The only reference supplied is Oracle's August 2026 Critical Patch Update security alert page. Administrators running the affected 12.2.1.4.0 or 14.1.2.1.0 releases should consult that advisory for the applicable patch. No additional remediation guidance or required-action deadline was present in the supplied source material.
Sources
- NVD, CVE-2026-61258 record (source:
[email protected], published 2026-08-18) - Oracle Security Alerts; Critical Patch Update, August 2026: https://www.oracle.com/security-alerts/cspuaug2026.html