Oracle has disclosed a CVSS 9.9 vulnerability in the Oracle Internet Directory LDAP Server that, according to Oracle's own assessment, could allow a low-privileged network attacker to compromise the directory and affect adjacent products. No public exploitation or proof-of-concept has been reported, and the description below reflects vendor and NVD scoring rather than observed attacks.
What Is It
CVE-2026-83055 is a critical vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware, specifically in the OID LDAP Server component. Oracle describes it as easily exploitable: an attacker with low privileges and network access over LDAP can compromise Oracle Internet Directory outright.
The CVSS 3.1 base score is 9.9 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That combination, network attack vector, low attack complexity, no user interaction, and a changed scope, is close to the worst case short of full unauthenticated access. Per Oracle's description, successful attacks result in complete takeover of Oracle Internet Directory, with high impact to confidentiality, integrity, and availability.
Why It Matters
The scope change is the part worth reading twice. Oracle states that while the vulnerability resides in Oracle Internet Directory, attacks may significantly impact additional products. OID is a directory service; it holds identity and authentication data that other Fusion Middleware components rely on. A takeover there would not be contained to one server; the CVSS scope flag indicates the blast radius extends past the vulnerable component's security boundary. Oracle does not enumerate which additional products are affected, so the practical reach in any given environment has to be assessed locally.
The privilege requirement is low, not none, so an attacker needs some foothold. Neither Oracle nor the NVD record specifies which privilege level qualifies, so the practical bar is unconfirmed, but in many deployments, an ordinary authenticated directory user or a compromised service account with LDAP reachability would be a plausible starting point. Defenders should assume the requirement is modest until Oracle documents otherwise.
What's Vulnerable
Supported versions affected, per Oracle:
- Oracle Internet Directory 12.2.1.4.0
- Oracle Internet Directory 14.1.2.1.0
The vulnerable component is the OID LDAP Server. No CPE data has been published in the NVD record at this time, so automated matching by vulnerability scanners and SBOM tooling may not yet flag affected installs; version checks should be done manually against the list above.
Patch Status
The CVE was published to the NVD on 2026-09-15 with a status of Received: it has not yet completed NVD analysis, so the enrichment data in the record may change. The CVE record points to an Oracle Critical Patch Update / Security Alert page as its only patch reference; that link has not been independently verified as live at the time of writing, and the exact advisory URL should be confirmed against Oracle's Security Alerts index rather than assumed. The reference does not name specific patch numbers or fixed version strings, so administrators should locate the current advisory for their release and deployment directly from Oracle.
There is no CISA KEV entry for CVE-2026-83055 in the KEV catalog at this time. That means no active exploitation has been confirmed by CISA and no KEV-mandated remediation deadline applies to federal civilian agencies; it is not evidence that exploitation is absent, and KEV status can change as reporting develops.
Sources
- NVD, CVE-2026-83055: https://nvd.nist.gov/vuln/detail/CVE-2026-83055
- Oracle Security Alert ([email protected]): https://www.oracle.com/security-alerts/cspusep2026.html
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog