## Summary
CVE-2026-83058 is a critical vulnerability in Oracle Fusion Middleware’s Oracle Internet Directory (OID) LDAP Server. It affects 12.2.1.4.0 and 14.1.2.1.0 and is described as easily exploitable by a low-privileged network attacker via LDAP.
Successful exploitation can lead to takeover of Oracle Internet Directory, with impacts to confidentiality, integrity, and availability.
## Technical Details
- Component: OID LDAP Server (Oracle Internet Directory)
- Attack vector: NETWORK
- Privileges required: PR:L (low privileged)
- User interaction: UI:N (none)
- Complexity: AC:L (low)
- CVSS 3.1: 9.9 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
## Affected
- Oracle Fusion Middleware – Oracle Internet Directory (OID LDAP Server)
- 12.2.1.4.0
- 14.1.2.1.0
## Impact
- Oracle Internet Directory takeover
- High impact on:
- Confidentiality (C:H)
- Integrity (I:H)
- Availability (A:H)
- Scope change is indicated (S:C), meaning compromise may affect additional products beyond OID.
## Mitigation
1. Patch immediately: apply the vendor’s fixed version(s) for Oracle Internet Directory OID LDAP Server (exact patch details not available from the provided references).
2. Restrict LDAP network exposure so only trusted clients can reach the OID LDAP Server (reduce AV:N exposure).
3. Monitor for suspicious LDAP activity consistent with low-privileged remote compromise attempts (specific detection indicators not available from the provided references).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H