CVE-2026-35312: Oracle Virtual Directory Auth Bypass Flaw

CVE-2026-35312 Overview

CVE-2026-35312 is a critical access control vulnerability in the Oracle Virtual Directory component of Oracle Fusion Middleware. The flaw resides in the Virtual Directory Server and is reachable over the network through the Lightweight Directory Access Protocol (LDAP). An unauthenticated attacker with network access can exploit the issue without user interaction. Successful exploitation results in complete takeover of the Oracle Virtual Directory instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert June 2026.

Critical Impact
Remote, unauthenticated LDAP attackers can take over Oracle Virtual Directory servers running versions 12.2.1.4.0 and 14.1.2.0.0.

Affected Products

Oracle Fusion Middleware — Oracle Virtual Directory 12.2.1.4.0
Oracle Fusion Middleware — Oracle Virtual Directory 14.1.2.0.0
Virtual Directory Server component

Discovery Timeline

2026-06-17 - CVE-2026-35312 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Disclosed in the Oracle Security Alert June 2026

Technical Details for CVE-2026-35312

Vulnerability Analysis

The vulnerability is categorized under [CWE-284] Improper Access Control. Oracle Virtual Directory acts as an LDAP proxy that aggregates identity data from heterogeneous back-end stores. The Virtual Directory Server exposes LDAP services on the network and fails to enforce proper access controls on inbound requests. An attacker who can reach the LDAP listener can bypass authorization checks and gain control over the directory service.

Because Oracle Virtual Directory frequently sits in front of enterprise identity stores, compromise of the server can expose credential metadata, group memberships, and downstream directory contents. The attack requires no privileges and no user interaction, and it can be launched remotely with low complexity.

Root Cause

The root cause is improper access control in the Virtual Directory Server component. The service does not adequately restrict actions performed by unauthenticated LDAP clients, allowing privileged operations to be invoked without valid credentials. The flaw is present in supported releases 12.2.1.4.0 and 14.1.2.0.0.

Attack Vector

The attack vector is the network-exposed LDAP interface of Oracle Virtual Directory. An attacker sends crafted LDAP requests to the Virtual Directory Server and bypasses access enforcement. Successful exploitation yields full takeover of the Oracle Virtual Directory instance, including the ability to read, modify, or disrupt directory operations.

No public proof-of-concept code is available at the time of publication. Refer to the Oracle Security Alert June 2026 for vendor technical details.

Detection Methods for CVE-2026-35312

Indicators of Compromise

Unexpected LDAP bind or operation requests from external or untrusted source addresses to the Virtual Directory Server.
Anomalous administrative or schema-modifying LDAP operations performed without a corresponding authenticated session.
New or modified directory entries, adapters, or routing rules in Oracle Virtual Directory configuration files.
Spikes in LDAP traffic volume against Oracle Virtual Directory listeners.

Detection Strategies

Inventory all Oracle Fusion Middleware deployments and identify Oracle Virtual Directory instances running versions 12.2.1.4.0 or 14.1.2.0.0.
Enable verbose LDAP audit logging on Virtual Directory Server and forward events to a centralized analytics platform.
Correlate inbound LDAP source addresses against expected application and identity client allowlists.
Hunt for unauthenticated operations that return success codes on sensitive directory branches.

Monitoring Recommendations

Continuously monitor Oracle Virtual Directory process behavior, configuration file integrity, and child process creation.
Alert on outbound network connections originating from the Virtual Directory Server host to unusual destinations.
Track changes to operating system accounts and service binaries on hosts running Oracle Fusion Middleware.

How to Mitigate CVE-2026-35312

Immediate Actions Required

Apply the fixes published in the Oracle Security Alert June 2026 to all affected Oracle Virtual Directory deployments.
Restrict network exposure of the Virtual Directory Server LDAP port to trusted application subnets only.
Review Oracle Virtual Directory configuration and adapter definitions for unauthorized changes.
Rotate credentials and secrets that may have been exposed through the proxied directory back ends.

Patch Information

Oracle addressed CVE-2026-35312 in the June 2026 Critical Patch Update. Administrators should review the Oracle Security Alert June 2026 for the specific patch identifiers applicable to Oracle Virtual Directory versions 12.2.1.4.0 and 14.1.2.0.0, then schedule deployment according to Oracle's documented procedures.

Workarounds

Place Oracle Virtual Directory behind a network access control layer that limits LDAP clients to known identities and source addresses.
Disable or firewall any unused LDAP listener interfaces on the Virtual Directory Server host.
Increase audit logging verbosity and review logs daily until the official patch is applied.

bash

# Example iptables rule to restrict LDAP access to trusted subnets
iptables -A INPUT -p tcp --dport 389 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 636 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -j DROP
iptables -A INPUT -p tcp --dport 636 -j DROP