Oracle has disclosed CVE-2026-83058, a critical vulnerability in the Oracle Internet Directory LDAP Server that lets a low-privileged network attacker fully take over the directory and reach beyond it into adjacent products.
What Is It
The flaw sits in the OID LDAP Server component of Oracle Internet Directory, part of Oracle Fusion Middleware. Oracle describes it as easily exploitable: an attacker with low privileges and network access over LDAP can compromise Oracle Internet Directory outright. Successful exploitation can result in complete takeover of the product.
The CVSS 3.1 base score is 9.9 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Network attack vector, low complexity, no user interaction, and high impact across confidentiality, integrity, and availability.
Why It Matters
Two things push this beyond an ordinary critical bug. First is the scope change (S:C), Oracle explicitly notes that while the vulnerability lives in Oracle Internet Directory, attacks may significantly impact additional products. A directory service compromise is rarely contained to the directory itself.
Second is the low bar for entry. Only low privileges are required, no user interaction is needed, and the attack complexity is rated low. On the basis of the published metrics, an authenticated foothold able to reach the LDAP listener appears sufficient in most deployments.
Public reporting has not established confirmed in-the-wild exploitation at this time. That does not lower the urgency given the score and the exploitability profile.
What's Vulnerable
Per Oracle, the affected supported versions are:
- Oracle Internet Directory 12.2.1.4.0
- Oracle Internet Directory 14.1.2.1.0
Both are components of Oracle Fusion Middleware. No CPE data was published in the NVD record at time of writing.
Patch Status
The CVE was published on 2026-09-15 with an NVD status of "Received," meaning the record has not yet completed NVD analysis. Because the entry is still unanalyzed, no vendor patch reference has been confirmed through the NVD record, and this brief does not assert that a fix is already available.
Oracle's scheduled Critical Patch Updates ship in January, April, July, and October, so a mid-September disclosure falls outside that cycle. Whether Oracle addresses it in an out-of-cycle Security Alert or holds it for the October CPU has not been established from the sources available at time of writing; administrators should check Oracle's security alerts index directly rather than rely on a specific advisory identifier.
In the meantime, the durable action is exposure reduction: restrict network reachability of the OID LDAP listener to trusted management networks, review and tighten the privileges of low-tier directory accounts, and monitor LDAP authentication and bind activity for anomalies. Apply the vendor fix as soon as Oracle confirms one for 12.2.1.4.0 and 14.1.2.1.0.
Sources
- NVD, CVE-2026-83058: https://nvd.nist.gov/vuln/detail/CVE-2026-83058
- Oracle security alerts (URL below could not be validated against Oracle's published advisory naming; treat as unconfirmed and navigate from Oracle's security alerts index instead): https://www.oracle.com/security-alerts/cspusep2026.html