CVE-2026-61241: Oracle Internet Directory Auth Bypass

CVE-2026-61241 Overview

CVE-2026-61241 is a critical vulnerability in the Oracle Internet Directory (OID) product of Oracle Fusion Middleware, specifically within the OID Lightweight Directory Access Protocol (LDAP) Server component. The flaw allows an unauthenticated attacker with network access via LDAP to fully compromise Oracle Internet Directory. Successful exploitation results in complete takeover of the directory service and, because the scope changes, can significantly impact additional integrated products. Affected versions include Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0. Oracle addressed the issue in its August 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can take over Oracle Internet Directory via LDAP, with scope change extending impact to connected identity-consuming applications.

Affected Products

Oracle Internet Directory 12.2.1.4.0
Oracle Internet Directory 14.1.2.1.0
Oracle Fusion Middleware deployments that rely on OID for identity services

Discovery Timeline

2026-08-18 - CVE-2026-61241 published to NVD
2026-08-20 - Last updated in NVD database
August 2026 - Oracle releases fix in the Oracle Critical Patch Update Advisory

Technical Details for CVE-2026-61241

Vulnerability Analysis

The vulnerability resides in the OID LDAP Server component that processes directory operations over the LDAP protocol. An unauthenticated attacker sends crafted LDAP traffic to a reachable Oracle Internet Directory instance and takes control of the service. Because Oracle Internet Directory frequently acts as the authoritative identity store for Fusion Middleware, WebLogic, and downstream applications, compromise can cascade across the identity trust boundary. Oracle categorizes this as a scope-changing issue, meaning the attacker escapes the OID security authority and can influence resources managed by other products.

Confidentiality, integrity, and availability are all fully impacted. An attacker who takes over the directory can read every stored credential attribute, modify group memberships and access rules, and disrupt authentication for every service that binds to OID.

Root Cause

The National Vulnerability Database lists the weakness class as NVD-CWE-noinfo, and Oracle has not published the underlying flaw class in its public advisory. The exposure is reachable pre-authentication over the LDAP service port, indicating that the defect lies in code paths executed before bind validation completes. Detailed root-cause information is available only to Oracle Support customers through the Critical Patch Update notes.

Attack Vector

The attack is delivered over the network via LDAP, requires no privileges, and requires no user interaction. Any client able to reach the LDAP listener (typically TCP 389 for ldap:// or TCP 636 for ldaps://) can attempt exploitation. Internet-exposed OID instances are directly at risk. Instances reachable only from internal networks remain exploitable by any attacker who has already achieved a foothold on an adjacent host or VLAN. See the Oracle Security Alert for vendor guidance.

Detection Methods for CVE-2026-61241

Indicators of Compromise

Unexpected LDAP bind or extended operation requests from untrusted source IP addresses to OID listeners on TCP 389 or 636.
Abnormal creation, modification, or deletion of privileged OID entries such as cn=orcladmin or entries under cn=OracleContext.
New or unexplained replication agreements, ACL changes, or password policy modifications in OID audit logs.
OID process crashes, restarts, or memory anomalies recorded in oidldapd diagnostic logs.

Detection Strategies

Ingest OID access, audit, and diagnostic logs into a centralized analytics platform and alert on pre-bind protocol errors correlated with successful follow-up operations.
Baseline normal LDAP client populations and flag first-seen source addresses that issue write or modify operations.
Correlate directory changes with downstream Fusion Middleware authentication anomalies to identify scope-change abuse.

Monitoring Recommendations

Enable verbose OID audit policy for bind, modify, add, delete, and compare operations against sensitive containers.
Monitor network flows to LDAP ports from segments that do not host approved directory clients.
Track process integrity and configuration file changes on OID hosts to detect post-exploitation persistence.

How to Mitigate CVE-2026-61241

Immediate Actions Required

Apply the August 2026 Oracle Critical Patch Update to every Oracle Internet Directory instance running 12.2.1.4.0 or 14.1.2.1.0.
Inventory all OID deployments, including non-production and disaster recovery environments, and confirm patch status.
Restrict network reachability of the LDAP listener to known application tiers using firewall or security group rules.
Rotate orcladmin and other privileged directory credentials after patching if exposure is suspected.

Patch Information

Oracle released the fix as part of the August 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update Advisory for the exact patch bundle identifiers and prerequisite Fusion Middleware bundle patches. Upgrade both affected release trains, since backported fixes are shipped separately for 12.2.1.4.0 and 14.1.2.1.0.

Workarounds

Place OID behind an LDAP-aware proxy or firewall that terminates untrusted connections until patching is complete.
Enforce ldaps:// with mutual TLS and restrict source IPs at the network layer to trusted middleware hosts.
Disable or block anonymous LDAP operations where feasible and audit ACLs granting write access to sensitive containers.
Isolate OID hosts on a dedicated segment with egress restrictions to reduce blast radius from scope-changing exploitation.

bash

# Example: restrict OID LDAP listener to trusted middleware subnets (iptables)
iptables -A INPUT -p tcp --dport 636 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 636 -j DROP
iptables -A INPUT -p tcp --dport 389 -j DROP