CVE-2026-83066: Oracle Internet Directory Auth Bypass Flaw

CVE-2026-83066 Overview

CVE-2026-83066 is an authentication weakness [CWE-287] in the Oracle Internet Directory (OID) product of Oracle Fusion Middleware. The flaw resides in the OID LDAP Server component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via T3 or Internet Inter-ORB Protocol (IIOP) can compromise the directory server. Successful exploitation results in full takeover of Oracle Internet Directory, impacting confidentiality, integrity, and availability. Oracle published the issue in its September 2026 Security Alert (CSPUSEP2026).

Critical Impact
An unauthenticated remote attacker can take over Oracle Internet Directory through T3 or IIOP, exposing all directory data and identity trust relationships.

Affected Products

Oracle Fusion Middleware — Oracle Internet Directory 12.2.1.4.0
Oracle Fusion Middleware — Oracle Internet Directory 14.1.2.1.0
OID LDAP Server component exposed over T3 or IIOP

Discovery Timeline

2026-09-15 - CVE-2026-83066 published to NVD
2026-09-16 - Last updated in NVD database
2026 - Addressed in Oracle Security Alert CSPUSEP2026

Technical Details for CVE-2026-83066

Vulnerability Analysis

The vulnerability is an authentication bypass in the OID LDAP Server component of Oracle Internet Directory. Because the flaw is reachable over T3 and IIOP without credentials, an attacker on the network can invoke privileged directory operations without proving identity. Oracle Internet Directory stores enterprise user, group, and policy data used by other Fusion Middleware components. Full takeover therefore extends beyond the directory itself and threatens downstream applications that consume OID for authentication or authorization. The Exploit Prediction Scoring System (EPSS) currently rates the vulnerability at 0.483% as of 2026-09-16.

Root Cause

The root cause is an improper authentication weakness classified under [CWE-287]. The OID LDAP Server accepts requests over Oracle's proprietary T3 protocol and CORBA IIOP without enforcing the authentication checks required for the exposed operations. Network exposure of these management protocols, combined with the missing identity verification, allows an attacker to reach privileged code paths directly.

Attack Vector

Exploitation requires network reachability to the OID LDAP Server ports handling T3 or IIOP traffic. No user interaction, prior privileges, or victim actions are required. An attacker crafts protocol messages that invoke administrative or privileged LDAP operations, bypassing the authentication layer. Successful requests yield read, write, and control access to the directory, enabling credential theft, entry modification, and denial of service against dependent services.

No verified public exploit code is available for CVE-2026-83066. Refer to the Oracle Security Alert CSPUSEP2026 for vendor technical details.

Detection Methods for CVE-2026-83066

Indicators of Compromise

Unexpected T3 or IIOP connections to Oracle Internet Directory listener ports from untrusted network segments.
LDAP entries modified, created, or deleted without a corresponding administrator session in audit logs.
New privileged accounts, group memberships, or ACL changes appearing in OID without a change record.
Unusual bind or search activity originating from application-tier hosts that do not normally query OID directly.

Detection Strategies

Compare OID audit logs against change management records to surface out-of-band directory modifications.
Alert on inbound T3 or IIOP traffic to OID hosts from segments outside the middleware management zone.
Baseline normal LDAP operation volume per source host and flag statistically significant deviations.

Monitoring Recommendations

Forward OID access, audit, and error logs to a centralized analytics platform for correlation with network telemetry.
Monitor Fusion Middleware WebLogic listeners for anomalous T3 and IIOP session establishment patterns.
Track authentication failures and privileged operation counts on OID to detect enumeration or bypass attempts.

How to Mitigate CVE-2026-83066

Immediate Actions Required

Apply the Oracle patches referenced in Oracle Security Alert CSPUSEP2026 to all instances of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0.
Restrict network access to T3 and IIOP listener ports so that only trusted middleware hosts can reach them.
Review OID audit logs for suspicious directory changes since the affected versions were deployed.
Rotate credentials, service account passwords, and secrets stored in or protected by the directory if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-83066 in the security update bundle published as CSPUSEP2026. Administrators must apply the vendor-supplied patch for their exact Oracle Internet Directory release. See the Oracle Security Alert CSPUSEP2026 for downloads, prerequisites, and post-installation steps.

Workarounds

Block T3 and IIOP protocols at the network perimeter and permit them only from explicitly trusted management hosts.
Configure WebLogic connection filters to deny T3 and IIOP connections from unauthorized source addresses.
Place Oracle Internet Directory behind a dedicated management VLAN with strict firewall rules until patching completes.
Disable IIOP on the OID managed server if it is not required for application integration.

bash

# WebLogic connection filter example to restrict T3 and IIOP to trusted subnets
# Set in the WebLogic console: Security -> Filter -> Connection Filter
# weblogic.security.net.ConnectionFilterImpl

10.10.20.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0     * * deny  t3 t3s iiop iiops