Cyber & AI intelligence
Wasteland.
Briefs indexed2663
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-83056 2026-09-15

Oracle Internet Directory Hit With Critical Scope-Changing LDAP Flaw (CVE-2026-83056)

"A critical vulnerability in the Oracle Internet Directory LDAP server could allow a low-privileged network attacker to take over the directory, and per Oracle's own assessment, exploitation may reach beyond it into…"

A critical vulnerability in the Oracle Internet Directory LDAP server could allow a low-privileged network attacker to take over the directory, and per Oracle's own assessment, exploitation may reach beyond it into adjacent products.

What Is It

CVE-2026-83056 is a vulnerability in the OID LDAP Server component of Oracle Internet Directory, part of Oracle Fusion Middleware. Oracle describes it as easily exploitable: an attacker with low privileges and network access over LDAP can compromise Oracle Internet Directory outright. Successful exploitation results in full takeover of the directory.

It carries a CVSS 3.1 base score of 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.

Why It Matters

The scope change (S:C) is the part worth stopping on. Oracle explicitly notes that while the flaw lives in Oracle Internet Directory, attacks may significantly impact additional products. A directory service sits at the center of authentication and identity for whatever else is wired into it, so a takeover here is not contained to one product boundary; it is a pivot point.

The bar to exploit is low. There is no user interaction requirement, attack complexity is rated low, and the attacker only needs some existing low-privilege foothold with LDAP reachability.

This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing, so there is no confirmed active exploitation to report and no KEV-mandated remediation deadline. That is a snapshot, not a guarantee; critical Oracle Fusion Middleware flaws with this profile tend to attract attention.

What's Vulnerable

Patch Status

The CVE was published 2026-09-15 with NVD status Received, meaning it has not yet completed NVD analysis. No specific fixed version numbers are stated in the supplied data.

The advisory reference requires verification before you act on it. Oracle ships Critical Patch Updates on a fixed quarterly cadence, January, April, July, and October, so a September Critical Patch Update would be off-cycle, and the advisory URL carried in the source data does not match the naming convention Oracle uses for its published Critical Patch Update and Security Alert pages. Treat the link below as an unconfirmed pointer rather than a canonical advisory: check Oracle's Critical Patch Update landing page and My Oracle Support for the patch that actually covers your deployed version, and confirm with Oracle Support if no matching advisory is published.

Regardless of where the fix lands, the 9.9 rating and the cross-product scope change put this at the top of the remediation queue. Until a confirmed patch is in hand, restrict LDAP reachability to the OID servers and audit which low-privilege accounts can reach the directory at all.

Sources