CVE-2026-83061: Oracle Internet Directory Auth Bypass

CVE-2026-83061 Overview

CVE-2026-83061 is an authentication weakness [CWE-287] in the Oracle Internet Directory (OID) LDAP Server component of Oracle Fusion Middleware. Supported versions 12.2.1.4.0 and 14.1.2.1.0 are affected. An unauthenticated attacker with network access via Lightweight Directory Access Protocol (LDAP) can compromise Oracle Internet Directory. Successful exploitation results in full takeover of the directory service, impacting the confidentiality, integrity, and availability of stored identity data.

Critical Impact

Unauthenticated network attackers can take over Oracle Internet Directory, exposing enterprise identity data and downstream applications that rely on OID for authentication.

Affected Products

• Oracle Fusion Middleware — Oracle Internet Directory 12.2.1.4.0
• Oracle Fusion Middleware — Oracle Internet Directory 14.1.2.1.0
• OID LDAP Server component

Discovery Timeline

• 2026-09-15 - CVE-2026-83061 published to NVD
• 2026-09-16 - Last updated in NVD database
• 2026-09 - Oracle publishes Security Alert CSPUSEP2026 with fixed versions

Technical Details for CVE-2026-83061

Vulnerability Analysis

The vulnerability resides in the OID LDAP Server, the network-facing component that handles LDAP binds, searches, and modifications. An unauthenticated attacker sends crafted LDAP traffic to a reachable OID instance and gains full control of the directory service. Because OID stores user accounts, group memberships, and application credentials, takeover extends far beyond a single service.

Oracle rates the flaw at CVSS 9.8 and classifies it under [CWE-287] Improper Authentication. Exploitation requires no user interaction and no prior privileges. The attack traverses the network, so any OID listener exposed to untrusted networks — including internal segments accessible to lateral movement — is at risk.

Root Cause

The root cause is an improper authentication flaw in the LDAP Server component. The service fails to correctly validate the identity presented during the LDAP bind or a related protocol operation, allowing an attacker to bypass authentication controls that normally gate directory operations.

Attack Vector

The attack vector is network-based over the LDAP protocol, typically TCP ports 389 (LDAP) or 636 (LDAPS). An attacker with reachability to the OID listener issues LDAP requests that bypass authentication and grant privileged directory access. Refer to the Oracle Security Alert CSPUSEP2026 for protocol-level details and affected code paths.

No public proof-of-concept has been observed at the time of publication. The current EPSS probability is 0.483%.

Detection Methods for CVE-2026-83061

Indicators of Compromise

• Successful LDAP bind events from unexpected source addresses, especially outside management subnets
• New or modified directory entries in privileged containers such as cn=orcladmin or cn=DirectoryManager
• Unexplained changes to OID access control lists (ACLs) or password policies
• OID replication or export operations initiated outside scheduled windows

Detection Strategies

• Enable OID audit logging for bind, modify, and add operations and forward events to a central SIEM
• Alert on privileged directory modifications originating from non-administrative source hosts
• Baseline normal LDAP client populations and flag first-seen source addresses issuing administrative operations
• Correlate OID authentication anomalies with downstream Fusion Middleware application logins

Monitoring Recommendations

• Monitor TCP 389 and 636 for volumetric or anomalous bind traffic from untrusted zones
• Track network exposure of OID listeners and alert when listeners appear on non-approved interfaces
• Review Oracle Enterprise Manager alerts for OID service restarts, configuration changes, and replication errors

How to Mitigate CVE-2026-83061

Immediate Actions Required

• Apply the Oracle Security Alert CSPUSEP2026 patch to all OID 12.2.1.4.0 and 14.1.2.1.0 instances without delay
• Restrict network access to OID LDAP listeners to trusted management and application subnets only
• Rotate credentials for orcladmin and any service accounts stored in OID after patching
• Review OID audit logs from the past 30 days for evidence of unauthorized administrative activity

Patch Information

Oracle addresses CVE-2026-83061 in the security update described in Oracle Security Alert CSPUSEP2026. Apply the fixes for Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 as documented in the alert. Follow standard Fusion Middleware patch prerequisites and validate replication and directory integrity after installation.

Workarounds

• Place OID listeners behind a firewall or LDAP-aware proxy that enforces source-address allowlisting
• Terminate LDAP on LDAPS-only listeners and require mutual TLS for administrative clients where supported
• Disable or restrict anonymous bind operations if not required by dependent applications
• Isolate OID from internet-facing network segments until patching is complete

# Example: restrict OID LDAP listeners at the host firewall (Linux, firewalld)
# Allow only the application and management subnets to reach 389/tcp and 636/tcp
sudo firewall-cmd --permanent --zone=drop --add-port=389/tcp
sudo firewall-cmd --permanent --zone=drop --add-port=636/tcp
sudo firewall-cmd --permanent --zone=trusted --add-source=10.20.0.0/24
sudo firewall-cmd --permanent --zone=trusted --add-source=10.30.0.0/24
sudo firewall-cmd --permanent --zone=trusted --add-port=389/tcp
sudo firewall-cmd --permanent --zone=trusted --add-port=636/tcp
sudo firewall-cmd --reload