EXPOSURES › CVE-2026-61241
CVE-2026-61241
CRITICALAn unauthenticated LDAP attacker can take over Oracle Internet Directory in versions 12.2.1.4.0 and 14.1.2.1.0.
CVE-2026-61241 allows an unauthenticated remote attacker to compromise Oracle Internet Directory via LDAP, leading to full system takeover. DIBs must patch these specific versions immediately, as the vulnerability impacts confidentiality, integrity, and availability without requiring authentication or user interaction.
Shame score — A critical CVSS 10.0 vulnerability allowing unauthenticated remote takeover of a core directory service is a severe, avoidable failure that directly threatens data integrity and availability.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Internet Directory. While the vulnerability is in Oracle Internet Directory, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Internet Directory. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |