CVE-2026-83059: Oracle Internet Directory Auth Bypass

CVE-2026-83059 Overview

CVE-2026-83059 is an authentication vulnerability [CWE-287] in the Oracle Internet Directory (OID) product of Oracle Fusion Middleware. The flaw resides in the OID LDAP Server component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via Lightweight Directory Access Protocol (LDAP) can compromise Oracle Internet Directory. Successful exploitation results in full takeover of the directory service. The vulnerability carries a scope change, meaning attacks can significantly impact additional products beyond Oracle Internet Directory itself.

Critical Impact
Unauthenticated network-based exploitation over LDAP leads to complete takeover of Oracle Internet Directory and cascading compromise of dependent Fusion Middleware components.

Affected Products

Oracle Fusion Middleware — Oracle Internet Directory 12.2.1.4.0
Oracle Fusion Middleware — Oracle Internet Directory 14.1.2.1.0
OID LDAP Server component

Discovery Timeline

2026-09-15 - CVE-2026-83059 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-83059

Vulnerability Analysis

The vulnerability affects the OID LDAP Server, the network-facing component of Oracle Internet Directory that services LDAP bind, search, and modify operations. An attacker sends crafted LDAP traffic to the exposed directory service and bypasses authentication controls. No credentials, prior privileges, or user interaction are required. Because the attack scope changes, a compromise of the directory propagates trust to downstream Fusion Middleware applications that rely on OID for identity, single sign-on, and authorization decisions. Directory takeover enables an attacker to add, modify, or delete identity records, escalate privileges across integrated applications, and pivot into other Oracle middleware services. The Oracle Security Alert designates this as a full confidentiality, integrity, and availability compromise.

Root Cause

The root cause is improper authentication [CWE-287] in the OID LDAP Server request handling path. The component fails to correctly validate authentication state before processing privileged directory operations, allowing an unauthenticated remote actor to act as a trusted principal.

Attack Vector

Exploitation occurs over the network via LDAP (typically TCP 389) or LDAPS (TCP 636). The attacker requires only reachability to the OID LDAP Server listener. Attack complexity is low and the operation does not require user interaction, making automated mass exploitation feasible against internet-exposed or lateral-reachable directory endpoints.

No verified public proof-of-concept code is available. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical details.

Detection Methods for CVE-2026-83059

Indicators of Compromise

Unexpected LDAP bind operations from untrusted source IPs on TCP 389 or 636 against OID servers
New or modified orclUser, orclGroup, or administrative directory entries without a corresponding change ticket
Anomalous LDAP modify or add operations targeting privileged branches such as cn=OracleContext or cn=Directory Manager
Fusion Middleware SSO sessions issued for accounts that did not perform interactive logon

Detection Strategies

Baseline LDAP request volume and alert on spikes in bind failures or anonymous operations targeting the OID LDAP Server
Correlate directory schema and ACL changes with authenticated administrator activity from oidldapd access logs
Inspect network flows for LDAP sessions originating from segments that do not normally communicate with directory services

Monitoring Recommendations

Forward oidldapd access and audit logs to a central analytics platform for retention and correlation
Enable Oracle Internet Directory audit policy for bind, modify, add, and delete operations on sensitive containers
Monitor Fusion Middleware WebLogic and SSO logs for authentication events that lack a corresponding directory bind

How to Mitigate CVE-2026-83059

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert CSPUSEP2026 to affected 12.2.1.4.0 and 14.1.2.1.0 deployments
Restrict network reachability of OID LDAP Server ports 389 and 636 to known application tier hosts via firewall or security group rules
Audit directory administrator accounts, ACLs, and recent schema modifications for signs of tampering
Rotate credentials and service account passwords stored in or authenticated by Oracle Internet Directory

Patch Information

Oracle addresses CVE-2026-83059 through the Critical Security Alert CSPUSEP2026. Administrators must apply the patches specified in the Oracle Security Alert CSPUSEP2026 for Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0. Oracle does not provide security patches for unsupported product versions, so environments running end-of-life releases must upgrade before applying fixes.

Workarounds

Place OID behind a network segmentation boundary that permits LDAP only from authorized Fusion Middleware application tiers
Terminate LDAPS at a reverse proxy that enforces mutual TLS to reduce the exposed attack surface until patches are applied
Disable anonymous bind and unused LDAP operations in the OID configuration where operationally feasible

bash

# Configuration example — restrict OID LDAP exposure with host firewall rules
# Allow only trusted application tier subnet to reach LDAP/LDAPS
iptables -A INPUT -p tcp -s 10.20.30.0/24 --dport 389 -j ACCEPT
iptables -A INPUT -p tcp -s 10.20.30.0/24 --dport 636 -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -j DROP
iptables -A INPUT -p tcp --dport 636 -j DROP